198 files changed, 4692 insertions, 15819 deletions
diff --git a/Documentation/nfc/nfc-hci.txt b/Documentation/nfc/nfc-hci.txt
index 320f9336c781..89a339c9b079 100644
--- a/Documentation/nfc/nfc-hci.txt
+++ b/Documentation/nfc/nfc-hci.txt
@@ -178,3 +178,36 @@ ANY_GET_PARAMETER to the reader A gate to get information on the target
 that was discovered).
 Typically, such an event will be propagated to NFC Core from MSGRXWQ context.
+Error management
+----------------
+Errors that occur synchronously with the execution of an NFC Core request are
+simply returned as the execution result of the request. These are easy.
+Errors that occur asynchronously (e.g. in a background protocol handling thread)
+must be reported such that upper layers don't stay ignorant that something
+went wrong below and know that expected events will probably never happen.
+Handling of these errors is done as follows:
+- driver (pn544) fails to deliver an incoming frame: it stores the error such
+that any subsequent call to the driver will result in this error. Then it calls
+the standard nfc_shdlc_recv_frame() with a NULL argument to report the problem
+above. shdlc stores a EREMOTEIO sticky status, which will trigger SMW to
+report above in turn.
+- SMW is basically a background thread to handle incoming and outgoing shdlc
+frames. This thread will also check the shdlc sticky status and report to HCI
+when it discovers it is not able to run anymore because of an unrecoverable
+error that happened within shdlc or below. If the problem occurs during shdlc
+connection, the error is reported through the connect completion.
+- HCI: if an internal HCI error happens (frame is lost), or HCI is reported an
+error from a lower layer, HCI will either complete the currently executing
+command with that error, or notify NFC Core directly if no command is executing.
+- NFC Core: when NFC Core is notified of an error from below and polling is
+active, it will send a tag discovered event with an empty tag list to the user
+space to let it know that the poll operation will never be able to detect a tag.
+If polling is not active and the error was sticky, lower levels will return it
+at next invocation.
diff --git a/MAINTAINERS b/MAINTAINERS
index ce7398e1e1ec..b4321fb74698 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3661,14 +3661,6 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi.git
 S:      Supported
 F:      drivers/net/wireless/iwlwifi/
-INTEL WIRELESS MULTICOMM 3200 WIFI (iwmc3200wifi)
-M:      Samuel Ortiz <samuel.ortiz@intel.com>
-M:      Intel Linux Wireless <ilw@linux.intel.com>
-L:      linux-wireless@vger.kernel.org
-S:      Supported
-W:      http://wireless.kernel.org/en/users/Drivers/iwmc3200wifi
-F:      drivers/net/wireless/iwmc3200wifi/
 INTEL MANAGEMENT ENGINE (mei)
 M:      Tomas Winkler <tomas.winkler@intel.com>
 L:      linux-kernel@vger.kernel.org
diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
index b81755bb4798..f6589eb7c45f 100644
--- a/drivers/bcma/bcma_private.h
+++ b/drivers/bcma/bcma_private.h
@@ -10,6 +10,15 @@
 #define BCMA_CORE_SIZE          0x1000
+#define bcma_err(bus, fmt, ...) \
+        pr_err("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
+#define bcma_warn(bus, fmt, ...) \
+        pr_warn("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
+#define bcma_info(bus, fmt, ...) \
+        pr_info("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
+#define bcma_debug(bus, fmt, ...) \
+        pr_debug("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
 struct bcma_bus;
 /* main.c */
diff --git a/drivers/bcma/core.c b/drivers/bcma/core.c
index bc6e89212ad3..63c8b470536f 100644
--- a/drivers/bcma/core.c
+++ b/drivers/bcma/core.c
@@ -75,7 +75,7 @@ void bcma_core_set_clockmode(struct bcma_device *core,
                        udelay(10);
                }
                if (i)
-                        pr_err("HT force timeout\n");
+                        bcma_err(core->bus, "HT force timeout\n");
                break;
        case BCMA_CLKMODE_DYNAMIC:
                bcma_set32(core, BCMA_CLKCTLST, ~BCMA_CLKCTLST_FORCEHT);
@@ -102,9 +102,9 @@ void bcma_core_pll_ctl(struct bcma_device *core, u32 req, u32 status, bool on)
                        udelay(10);
                }
                if (i)
-                        pr_err("PLL enable timeout\n");
+                        bcma_err(core->bus, "PLL enable timeout\n");
        } else {
-                pr_warn("Disabling PLL not supported yet!\n");
+                bcma_warn(core->bus, "Disabling PLL not supported yet!\n");
        }
 }
 EXPORT_SYMBOL_GPL(bcma_core_pll_ctl);
@@ -120,8 +120,8 @@ u32 bcma_core_dma_translation(struct bcma_device *core)
                else
                        return BCMA_DMA_TRANSLATION_DMA32_CMT;
        default:
-                pr_err("DMA translation unknown for host %d\n",
+                bcma_err(core->bus, "DMA translation unknown for host %d\n",
-                       core->bus->hosttype);
+                         core->bus->hosttype);
        }
        return BCMA_DMA_TRANSLATION_NONE;
 }
diff --git a/drivers/bcma/driver_chipcommon.c b/drivers/bcma/driver_chipcommon.c
index e9f1b3fd252c..a4c3ebcc4c86 100644
--- a/drivers/bcma/driver_chipcommon.c
+++ b/drivers/bcma/driver_chipcommon.c
@@ -44,7 +44,7 @@ void bcma_core_chipcommon_init(struct bcma_drv_cc *cc)
        if (cc->capabilities & BCMA_CC_CAP_PMU)
                bcma_pmu_init(cc);
        if (cc->capabilities & BCMA_CC_CAP_PCTL)
-                pr_err("Power control not implemented!\n");
+                bcma_err(cc->core->bus, "Power control not implemented!\n");
        if (cc->core->id.rev >= 16) {
                if (cc->core->bus->sprom.leddc_on_time &&
@@ -137,8 +137,7 @@ void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
                                       | BCMA_CC_CORECTL_UARTCLKEN);
                }
        } else {
-                pr_err("serial not supported on this device ccrev: 0x%x\n",
+                bcma_err(cc->core->bus, "serial not supported on this device ccrev: 0x%x\n", ccrev);
-                       ccrev);
                return;
        }
diff --git a/drivers/bcma/driver_chipcommon_pmu.c b/drivers/bcma/driver_chipcommon_pmu.c
index 61ce4054b3c3..44326178db29 100644
--- a/drivers/bcma/driver_chipcommon_pmu.c
+++ b/drivers/bcma/driver_chipcommon_pmu.c
@@ -3,7 +3,8 @@
 * ChipCommon Power Management Unit driver
 *
 * Copyright 2009, Michael Buesch <m@bues.ch>
- * Copyright 2007, Broadcom Corporation
+ * Copyright 2007, 2011, Broadcom Corporation
+ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
 *
 * Licensed under the GNU/GPL. See COPYING for details.
 */
@@ -54,39 +55,19 @@ void bcma_chipco_regctl_maskset(struct bcma_drv_cc *cc, u32 offset, u32 mask,
 }
 EXPORT_SYMBOL_GPL(bcma_chipco_regctl_maskset);
-static void bcma_pmu_pll_init(struct bcma_drv_cc *cc)
-{
-        struct bcma_bus *bus = cc->core->bus;
-        switch (bus->chipinfo.id) {
-        case 0x4313:
-        case 0x4331:
-        case 43224:
-        case 43225:
-                break;
-        default:
-                pr_err("PLL init unknown for device 0x%04X\n",
-                        bus->chipinfo.id);
-        }
-}
 static void bcma_pmu_resources_init(struct bcma_drv_cc *cc)
 {
        struct bcma_bus *bus = cc->core->bus;
        u32 min_msk = 0, max_msk = 0;
        switch (bus->chipinfo.id) {
-        case 0x4313:
+        case BCMA_CHIP_ID_BCM4313:
                min_msk = 0x200D;
                max_msk = 0xFFFF;
                break;
-        case 0x4331:
-        case 43224:
-        case 43225:
-                break;
        default:
-                pr_err("PMU resource config unknown for device 0x%04X\n",
+                bcma_debug(bus, "PMU resource config unknown or not needed for device 0x%04X\n",
-                        bus->chipinfo.id);
+                           bus->chipinfo.id);
        }
        /* Set the resource masks. */
@@ -94,22 +75,9 @@ static void bcma_pmu_resources_init(struct bcma_drv_cc *cc)
                bcma_cc_write32(cc, BCMA_CC_PMU_MINRES_MSK, min_msk);
        if (max_msk)
                bcma_cc_write32(cc, BCMA_CC_PMU_MAXRES_MSK, max_msk);
-}
-void bcma_pmu_swreg_init(struct bcma_drv_cc *cc)
-{
-        struct bcma_bus *bus = cc->core->bus;
-        switch (bus->chipinfo.id) {
+        /* Add some delay; allow resources to come up and settle. */
-        case 0x4313:
+        mdelay(2);
-        case 0x4331:
-        case 43224:
-        case 43225:
-                break;
-        default:
-                pr_err("PMU switch/regulators init unknown for device "
-                        "0x%04X\n", bus->chipinfo.id);
-        }
 }
 /* Disable to allow reading SPROM. Don't know the adventages of enabling it. */
@@ -123,8 +91,11 @@ void bcma_chipco_bcm4331_ext_pa_lines_ctl(struct bcma_drv_cc *cc, bool enable)
                val |= BCMA_CHIPCTL_4331_EXTPA_EN;
                if (bus->chipinfo.pkg == 9 || bus->chipinfo.pkg == 11)
                        val |= BCMA_CHIPCTL_4331_EXTPA_ON_GPIO2_5;
+                else if (bus->chipinfo.rev > 0)
+                        val |= BCMA_CHIPCTL_4331_EXTPA_EN2;
        } else {
                val &= ~BCMA_CHIPCTL_4331_EXTPA_EN;
+                val &= ~BCMA_CHIPCTL_4331_EXTPA_EN2;
                val &= ~BCMA_CHIPCTL_4331_EXTPA_ON_GPIO2_5;
        }
        bcma_cc_write32(cc, BCMA_CC_CHIPCTL, val);
@@ -135,28 +106,38 @@ void bcma_pmu_workarounds(struct bcma_drv_cc *cc)
        struct bcma_bus *bus = cc->core->bus;
        switch (bus->chipinfo.id) {
-        case 0x4313:
+        case BCMA_CHIP_ID_BCM4313:
-                bcma_chipco_chipctl_maskset(cc, 0, ~0, 0x7);
+                /* enable 12 mA drive strenth for 4313 and set chipControl
+                   register bit 1 */
+                bcma_chipco_chipctl_maskset(cc, 0,
+                                            BCMA_CCTRL_4313_12MA_LED_DRIVE,
+                                            BCMA_CCTRL_4313_12MA_LED_DRIVE);
                break;
-        case 0x4331:
+        case BCMA_CHIP_ID_BCM4331:
-        case 43431:
+        case BCMA_CHIP_ID_BCM43431:
                /* Ext PA lines must be enabled for tx on BCM4331 */
                bcma_chipco_bcm4331_ext_pa_lines_ctl(cc, true);
                break;
-        case 43224:
+        case BCMA_CHIP_ID_BCM43224:
+        case BCMA_CHIP_ID_BCM43421:
+                /* enable 12 mA drive strenth for 43224 and set chipControl
+                   register bit 15 */
                if (bus->chipinfo.rev == 0) {
-                        pr_err("Workarounds for 43224 rev 0 not fully "
+                        bcma_cc_maskset32(cc, BCMA_CC_CHIPCTL,
-                                "implemented\n");
+                                          BCMA_CCTRL_43224_GPIO_TOGGLE,
-                        bcma_chipco_chipctl_maskset(cc, 0, ~0, 0x00F000F0);
+                                          BCMA_CCTRL_43224_GPIO_TOGGLE);
+                        bcma_chipco_chipctl_maskset(cc, 0,
+                                                    BCMA_CCTRL_43224A0_12MA_LED_DRIVE,
+                                                    BCMA_CCTRL_43224A0_12MA_LED_DRIVE);
                } else {
-                        bcma_chipco_chipctl_maskset(cc, 0, ~0, 0xF0);
+                        bcma_chipco_chipctl_maskset(cc, 0,
+                                                    BCMA_CCTRL_43224B0_12MA_LED_DRIVE,
+                                                    BCMA_CCTRL_43224B0_12MA_LED_DRIVE);
                }
                break;
-        case 43225:
-                break;
        default:
-                pr_err("Workarounds unknown for device 0x%04X\n",
+                bcma_debug(bus, "Workarounds unknown or not needed for device 0x%04X\n",
-                        bus->chipinfo.id);
+                           bus->chipinfo.id);
        }
 }
@@ -167,8 +148,8 @@ void bcma_pmu_init(struct bcma_drv_cc *cc)
        pmucap = bcma_cc_read32(cc, BCMA_CC_PMU_CAP);
        cc->pmu.rev = (pmucap & BCMA_CC_PMU_CAP_REVISION);
-        pr_debug("Found rev %u PMU (capabilities 0x%08X)\n", cc->pmu.rev,
+        bcma_debug(cc->core->bus, "Found rev %u PMU (capabilities 0x%08X)\n",
-                 pmucap);
+                   cc->pmu.rev, pmucap);
        if (cc->pmu.rev == 1)
                bcma_cc_mask32(cc, BCMA_CC_PMU_CTL,
@@ -177,12 +158,7 @@ void bcma_pmu_init(struct bcma_drv_cc *cc)
                bcma_cc_set32(cc, BCMA_CC_PMU_CTL,
                             BCMA_CC_PMU_CTL_NOILPONW);
-        if (cc->core->id.id == 0x4329 && cc->core->id.rev == 2)
-                pr_err("Fix for 4329b0 bad LPOM state not implemented!\n");
-        bcma_pmu_pll_init(cc);
        bcma_pmu_resources_init(cc);
-        bcma_pmu_swreg_init(cc);
        bcma_pmu_workarounds(cc);
 }
@@ -191,23 +167,22 @@ u32 bcma_pmu_alp_clock(struct bcma_drv_cc *cc)
        struct bcma_bus *bus = cc->core->bus;
        switch (bus->chipinfo.id) {
-        case 0x4716:
+        case BCMA_CHIP_ID_BCM4716:
-        case 0x4748:
+        case BCMA_CHIP_ID_BCM4748:
-        case 47162:
+        case BCMA_CHIP_ID_BCM47162:
-        case 0x4313:
+        case BCMA_CHIP_ID_BCM4313:
-        case 0x5357:
+        case BCMA_CHIP_ID_BCM5357:
-        case 0x4749:
+        case BCMA_CHIP_ID_BCM4749:
-        case 53572:
+        case BCMA_CHIP_ID_BCM53572:
                /* always 20Mhz */
                return 20000 * 1000;
-        case 0x5356:
+        case BCMA_CHIP_ID_BCM5356:
-        case 0x5300:
+        case BCMA_CHIP_ID_BCM4706:
                /* always 25Mhz */
                return 25000 * 1000;
        default:
-                pr_warn("No ALP clock specified for %04X device, "
+                bcma_warn(bus, "No ALP clock specified for %04X device, pmu rev. %d, using default %d Hz\n",
-                        "pmu rev. %d, using default %d Hz\n",
+                          bus->chipinfo.id, cc->pmu.rev, BCMA_CC_PMU_ALP_CLOCK);
-                        bus->chipinfo.id, cc->pmu.rev, BCMA_CC_PMU_ALP_CLOCK);
        }
        return BCMA_CC_PMU_ALP_CLOCK;
 }
@@ -224,7 +199,8 @@ static u32 bcma_pmu_clock(struct bcma_drv_cc *cc, u32 pll0, u32 m)
        BUG_ON(!m || m > 4);
-        if (bus->chipinfo.id == 0x5357 || bus->chipinfo.id == 0x4749) {
+        if (bus->chipinfo.id == BCMA_CHIP_ID_BCM5357 ||
+            bus->chipinfo.id == BCMA_CHIP_ID_BCM4749) {
                /* Detect failure in clock setting */
                tmp = bcma_cc_read32(cc, BCMA_CC_CHIPSTAT);
                if (tmp & 0x40000)
@@ -250,33 +226,62 @@ static u32 bcma_pmu_clock(struct bcma_drv_cc *cc, u32 pll0, u32 m)
        return (fc / div) * 1000000;
 }
+static u32 bcma_pmu_clock_bcm4706(struct bcma_drv_cc *cc, u32 pll0, u32 m)
+{
+        u32 tmp, ndiv, p1div, p2div;
+        u32 clock;
+        BUG_ON(!m || m > 4);
+        /* Get N, P1 and P2 dividers to determine CPU clock */
+        tmp = bcma_chipco_pll_read(cc, pll0 + BCMA_CC_PMU6_4706_PROCPLL_OFF);
+        ndiv = (tmp & BCMA_CC_PMU6_4706_PROC_NDIV_INT_MASK)
+                >> BCMA_CC_PMU6_4706_PROC_NDIV_INT_SHIFT;
+        p1div = (tmp & BCMA_CC_PMU6_4706_PROC_P1DIV_MASK)
+                >> BCMA_CC_PMU6_4706_PROC_P1DIV_SHIFT;
+        p2div = (tmp & BCMA_CC_PMU6_4706_PROC_P2DIV_MASK)
+                >> BCMA_CC_PMU6_4706_PROC_P2DIV_SHIFT;
+        tmp = bcma_cc_read32(cc, BCMA_CC_CHIPSTAT);
+        if (tmp & BCMA_CC_CHIPST_4706_PKG_OPTION)
+                /* Low cost bonding: Fixed reference clock 25MHz and m = 4 */
+                clock = (25000000 / 4) * ndiv * p2div / p1div;
+        else
+                /* Fixed reference clock 25MHz and m = 2 */
+                clock = (25000000 / 2) * ndiv * p2div / p1div;
+        if (m == BCMA_CC_PMU5_MAINPLL_SSB)
+                clock = clock / 4;
+        return clock;
+}
 /* query bus clock frequency for PMU-enabled chipcommon */
 u32 bcma_pmu_get_clockcontrol(struct bcma_drv_cc *cc)
 {
        struct bcma_bus *bus = cc->core->bus;
        switch (bus->chipinfo.id) {
-        case 0x4716:
+        case BCMA_CHIP_ID_BCM4716:
-        case 0x4748:
+        case BCMA_CHIP_ID_BCM4748:
-        case 47162:
+        case BCMA_CHIP_ID_BCM47162:
                return bcma_pmu_clock(cc, BCMA_CC_PMU4716_MAINPLL_PLL0,
                                      BCMA_CC_PMU5_MAINPLL_SSB);
-        case 0x5356:
+        case BCMA_CHIP_ID_BCM5356:
                return bcma_pmu_clock(cc, BCMA_CC_PMU5356_MAINPLL_PLL0,
                                      BCMA_CC_PMU5_MAINPLL_SSB);
-        case 0x5357:
+        case BCMA_CHIP_ID_BCM5357:
-        case 0x4749:
+        case BCMA_CHIP_ID_BCM4749:
                return bcma_pmu_clock(cc, BCMA_CC_PMU5357_MAINPLL_PLL0,
                                      BCMA_CC_PMU5_MAINPLL_SSB);
-        case 0x5300:
+        case BCMA_CHIP_ID_BCM4706:
-                return bcma_pmu_clock(cc, BCMA_CC_PMU4706_MAINPLL_PLL0,
+                return bcma_pmu_clock_bcm4706(cc, BCMA_CC_PMU4706_MAINPLL_PLL0,
-                                      BCMA_CC_PMU5_MAINPLL_SSB);
+                                              BCMA_CC_PMU5_MAINPLL_SSB);
-        case 53572:
+        case BCMA_CHIP_ID_BCM53572:
                return 75000000;
        default:
-                pr_warn("No backplane clock specified for %04X device, "
+                bcma_warn(bus, "No backplane clock specified for %04X device, pmu rev. %d, using default %d Hz\n",
-                        "pmu rev. %d, using default %d Hz\n",
+                          bus->chipinfo.id, cc->pmu.rev, BCMA_CC_PMU_HT_CLOCK);
-                        bus->chipinfo.id, cc->pmu.rev, BCMA_CC_PMU_HT_CLOCK);
        }
        return BCMA_CC_PMU_HT_CLOCK;
 }
@@ -286,17 +291,21 @@ u32 bcma_pmu_get_clockcpu(struct bcma_drv_cc *cc)
 {
        struct bcma_bus *bus = cc->core->bus;
-        if (bus->chipinfo.id == 53572)
+        if (bus->chipinfo.id == BCMA_CHIP_ID_BCM53572)
                return 300000000;
        if (cc->pmu.rev >= 5) {
                u32 pll;
                switch (bus->chipinfo.id) {
-                case 0x5356:
+                case BCMA_CHIP_ID_BCM4706:
+                        return bcma_pmu_clock_bcm4706(cc,
+                                                BCMA_CC_PMU4706_MAINPLL_PLL0,
+                                                BCMA_CC_PMU5_MAINPLL_CPU);
+                case BCMA_CHIP_ID_BCM5356:
                        pll = BCMA_CC_PMU5356_MAINPLL_PLL0;
                        break;
-                case 0x5357:
+                case BCMA_CHIP_ID_BCM5357:
-                case 0x4749:
+                case BCMA_CHIP_ID_BCM4749:
                        pll = BCMA_CC_PMU5357_MAINPLL_PLL0;
                        break;
                default:
@@ -304,10 +313,188 @@ u32 bcma_pmu_get_clockcpu(struct bcma_drv_cc *cc)
                        break;
                }
-                /* TODO: if (bus->chipinfo.id == 0x5300)
-                  return si_4706_pmu_clock(sih, osh, cc, PMU4706_MAINPLL_PLL0, PMU5_MAINPLL_CPU); */
                return bcma_pmu_clock(cc, pll, BCMA_CC_PMU5_MAINPLL_CPU);
        }
        return bcma_pmu_get_clockcontrol(cc);
 }
+static void bcma_pmu_spuravoid_pll_write(struct bcma_drv_cc *cc, u32 offset,
+                                         u32 value)
+{
+        bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR, offset);
+        bcma_cc_write32(cc, BCMA_CC_PLLCTL_DATA, value);
+}
+void bcma_pmu_spuravoid_pllupdate(struct bcma_drv_cc *cc, int spuravoid)
+{
+        u32 tmp = 0;
+        u8 phypll_offset = 0;
+        u8 bcm5357_bcm43236_p1div[] = {0x1, 0x5, 0x5};
+        u8 bcm5357_bcm43236_ndiv[] = {0x30, 0xf6, 0xfc};
+        struct bcma_bus *bus = cc->core->bus;
+        switch (bus->chipinfo.id) {
+        case BCMA_CHIP_ID_BCM5357:
+        case BCMA_CHIP_ID_BCM4749:
+        case BCMA_CHIP_ID_BCM53572:
+                /* 5357[ab]0, 43236[ab]0, and 6362b0 */
+                /* BCM5357 needs to touch PLL1_PLLCTL[02],
+                   so offset PLL0_PLLCTL[02] by 6 */
+                phypll_offset = (bus->chipinfo.id == BCMA_CHIP_ID_BCM5357 ||
+                       bus->chipinfo.id == BCMA_CHIP_ID_BCM4749 ||
+                       bus->chipinfo.id == BCMA_CHIP_ID_BCM53572) ? 6 : 0;
+                /* RMW only the P1 divider */
+                bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR,
+                                BCMA_CC_PMU_PLL_CTL0 + phypll_offset);
+                tmp = bcma_cc_read32(cc, BCMA_CC_PLLCTL_DATA);
+                tmp &= (~(BCMA_CC_PMU1_PLL0_PC0_P1DIV_MASK));
+                tmp |= (bcm5357_bcm43236_p1div[spuravoid] << BCMA_CC_PMU1_PLL0_PC0_P1DIV_SHIFT);
+                bcma_cc_write32(cc, BCMA_CC_PLLCTL_DATA, tmp);
+                /* RMW only the int feedback divider */
+                bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR,
+                                BCMA_CC_PMU_PLL_CTL2 + phypll_offset);
+                tmp = bcma_cc_read32(cc, BCMA_CC_PLLCTL_DATA);
+                tmp &= ~(BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_MASK);
+                tmp |= (bcm5357_bcm43236_ndiv[spuravoid]) << BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_SHIFT;
+                bcma_cc_write32(cc, BCMA_CC_PLLCTL_DATA, tmp);
+                tmp = 1 << 10;
+                break;
+        case BCMA_CHIP_ID_BCM4331:
+        case BCMA_CHIP_ID_BCM43431:
+                if (spuravoid == 2) {
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
+                                                     0x11500014);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
+                                                     0x0FC00a08);
+                } else if (spuravoid == 1) {
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
+                                                     0x11500014);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
+                                                     0x0F600a08);
+                } else {
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
+                                                     0x11100014);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
+                                                     0x03000a08);
+                }
+                tmp = 1 << 10;
+                break;
+        case BCMA_CHIP_ID_BCM43224:
+        case BCMA_CHIP_ID_BCM43225:
+        case BCMA_CHIP_ID_BCM43421:
+                if (spuravoid == 1) {
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
+                                                     0x11500010);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL1,
+                                                     0x000C0C06);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
+                                                     0x0F600a08);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL3,
+                                                     0x00000000);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL4,
+                                                     0x2001E920);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
+                                                     0x88888815);
+                } else {
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
+                                                     0x11100010);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL1,
+                                                     0x000c0c06);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
+                                                     0x03000a08);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL3,
+                                                     0x00000000);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL4,
+                                                     0x200005c0);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
+                                                     0x88888815);
+                }
+                tmp = 1 << 10;
+                break;
+        case BCMA_CHIP_ID_BCM4716:
+        case BCMA_CHIP_ID_BCM4748:
+        case BCMA_CHIP_ID_BCM47162:
+                if (spuravoid == 1) {
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
+                                                     0x11500060);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL1,
+                                                     0x080C0C06);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
+                                                     0x0F600000);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL3,
+                                                     0x00000000);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL4,
+                                                     0x2001E924);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
+                                                     0x88888815);
+                } else {
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
+                                                     0x11100060);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL1,
+                                                     0x080c0c06);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
+                                                     0x03000000);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL3,
+                                                     0x00000000);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL4,
+                                                     0x200005c0);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
+                                                     0x88888815);
+                }
+                tmp = 3 << 9;
+                break;
+        case BCMA_CHIP_ID_BCM43227:
+        case BCMA_CHIP_ID_BCM43228:
+        case BCMA_CHIP_ID_BCM43428:
+                /* LCNXN */
+                /* PLL Settings for spur avoidance on/off mode,
+                   no on2 support for 43228A0 */
+                if (spuravoid == 1) {
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
+                                                     0x01100014);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL1,
+                                                     0x040C0C06);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
+                                                     0x03140A08);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL3,
+                                                     0x00333333);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL4,
+                                                     0x202C2820);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
+                                                     0x88888815);
+                } else {
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
+                                                     0x11100014);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL1,
+                                                     0x040c0c06);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
+                                                     0x03000a08);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL3,
+                                                     0x00000000);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL4,
+                                                     0x200005c0);
+                        bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
+                                                     0x88888815);
+                }
+                tmp = 1 << 10;
+                break;
+        default:
+                bcma_err(bus, "Unknown spuravoidance settings for chip 0x%04X, not changing PLL\n",
+                         bus->chipinfo.id);
+                break;
+        }
+        tmp |= bcma_cc_read32(cc, BCMA_CC_PMU_CTL);
+        bcma_cc_write32(cc, BCMA_CC_PMU_CTL, tmp);
+}
+EXPORT_SYMBOL_GPL(bcma_pmu_spuravoid_pllupdate);
diff --git a/drivers/bcma/driver_mips.c b/drivers/bcma/driver_mips.c
index c3e9dff4224e..ef34ed25bf00 100644
--- a/drivers/bcma/driver_mips.c
+++ b/drivers/bcma/driver_mips.c
@@ -22,15 +22,15 @@
 /* The 47162a0 hangs when reading MIPS DMP registers registers */
 static inline bool bcma_core_mips_bcm47162a0_quirk(struct bcma_device *dev)
 {
-        return dev->bus->chipinfo.id == 47162 && dev->bus->chipinfo.rev == 0 &&
+        return dev->bus->chipinfo.id == BCMA_CHIP_ID_BCM47162 &&
-               dev->id.id == BCMA_CORE_MIPS_74K;
+               dev->bus->chipinfo.rev == 0 && dev->id.id == BCMA_CORE_MIPS_74K;
 }
 /* The 5357b0 hangs when reading USB20H DMP registers */
 static inline bool bcma_core_mips_bcm5357b0_quirk(struct bcma_device *dev)
 {
-        return (dev->bus->chipinfo.id == 0x5357 ||
+        return (dev->bus->chipinfo.id == BCMA_CHIP_ID_BCM5357 ||
-                dev->bus->chipinfo.id == 0x4749) &&
+                dev->bus->chipinfo.id == BCMA_CHIP_ID_BCM4749) &&
               dev->bus->chipinfo.pkg == 11 &&
               dev->id.id == BCMA_CORE_USB20_HOST;
 }
@@ -143,8 +143,8 @@ static void bcma_core_mips_set_irq(struct bcma_device *dev, unsigned int irq)
                             1 << irqflag);
        }
-        pr_info("set_irq: core 0x%04x, irq %d => %d\n",
+        bcma_info(bus, "set_irq: core 0x%04x, irq %d => %d\n",
-                dev->id.id, oldirq + 2, irq + 2);
+                  dev->id.id, oldirq + 2, irq + 2);
 }
 static void bcma_core_mips_print_irq(struct bcma_device *dev, unsigned int irq)
@@ -173,7 +173,7 @@ u32 bcma_cpu_clock(struct bcma_drv_mips *mcore)
        if (bus->drv_cc.capabilities & BCMA_CC_CAP_PMU)
                return bcma_pmu_get_clockcpu(&bus->drv_cc);
-        pr_err("No PMU available, need this to get the cpu clock\n");
+        bcma_err(bus, "No PMU available, need this to get the cpu clock\n");
        return 0;
 }
 EXPORT_SYMBOL(bcma_cpu_clock);
@@ -185,10 +185,10 @@ static void bcma_core_mips_flash_detect(struct bcma_drv_mips *mcore)
        switch (bus->drv_cc.capabilities & BCMA_CC_CAP_FLASHT) {
        case BCMA_CC_FLASHT_STSER:
        case BCMA_CC_FLASHT_ATSER:
-                pr_err("Serial flash not supported.\n");
+                bcma_err(bus, "Serial flash not supported.\n");
                break;
        case BCMA_CC_FLASHT_PARA:
-                pr_info("found parallel flash.\n");
+                bcma_info(bus, "found parallel flash.\n");
                bus->drv_cc.pflash.window = 0x1c000000;
                bus->drv_cc.pflash.window_size = 0x02000000;
@@ -199,7 +199,7 @@ static void bcma_core_mips_flash_detect(struct bcma_drv_mips *mcore)
                        bus->drv_cc.pflash.buswidth = 2;
                break;
        default:
-                pr_err("flash not supported.\n");
+                bcma_err(bus, "flash not supported.\n");
        }
 }
@@ -209,7 +209,7 @@ void bcma_core_mips_init(struct bcma_drv_mips *mcore)
        struct bcma_device *core;
        bus = mcore->core->bus;
-        pr_info("Initializing MIPS core...\n");
+        bcma_info(bus, "Initializing MIPS core...\n");
        if (!mcore->setup_done)
                mcore->assigned_irqs = 1;
@@ -244,7 +244,7 @@ void bcma_core_mips_init(struct bcma_drv_mips *mcore)
                        break;
                }
        }
-        pr_info("IRQ reconfiguration done\n");
+        bcma_info(bus, "IRQ reconfiguration done\n");
        bcma_core_mips_dump_irq(bus);
        if (mcore->setup_done)
diff --git a/drivers/bcma/driver_pci_host.c b/drivers/bcma/driver_pci_host.c
index b9a86edfec39..cbae2c231336 100644
--- a/drivers/bcma/driver_pci_host.c
+++ b/drivers/bcma/driver_pci_host.c
@@ -36,7 +36,7 @@ bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
                return false;
        if (bus->sprom.boardflags_lo & BCMA_CORE_PCI_BFL_NOPCI) {
-                pr_info("This PCI core is disabled and not working\n");
+                bcma_info(bus, "This PCI core is disabled and not working\n");
                return false;
        }
@@ -215,7 +215,8 @@ static int bcma_extpci_write_config(struct bcma_drv_pci *pc, unsigned int dev,
        } else {
                writel(val, mmio);
-                if (chipid == 0x4716 || chipid == 0x4748)
+                if (chipid == BCMA_CHIP_ID_BCM4716 ||
+                    chipid == BCMA_CHIP_ID_BCM4748)
                        readl(mmio);
        }
@@ -340,6 +341,7 @@ static u8 __devinit bcma_find_pci_capability(struct bcma_drv_pci *pc,
 */
 static void __devinit bcma_core_pci_enable_crs(struct bcma_drv_pci *pc)
 {
+        struct bcma_bus *bus = pc->core->bus;
        u8 cap_ptr, root_ctrl, root_cap, dev;
        u16 val16;
        int i;
@@ -378,7 +380,8 @@ static void __devinit bcma_core_pci_enable_crs(struct bcma_drv_pci *pc)
                                udelay(10);
                        }
                        if (val16 == 0x1)
-                                pr_err("PCI: Broken device in slot %d\n", dev);
+                                bcma_err(bus, "PCI: Broken device in slot %d\n",
+                                         dev);
                }
        }
 }
@@ -391,11 +394,11 @@ void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
        u32 pci_membase_1G;
        unsigned long io_map_base;
-        pr_info("PCIEcore in host mode found\n");
+        bcma_info(bus, "PCIEcore in host mode found\n");
        pc_host = kzalloc(sizeof(*pc_host), GFP_KERNEL);
        if (!pc_host)  {
-                pr_err("can not allocate memory");
+                bcma_err(bus, "can not allocate memory");
                return;
        }
@@ -434,13 +437,14 @@ void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
         * as mips can't generate 64-bit address on the
         * backplane.
         */
-        if (bus->chipinfo.id == 0x4716 || bus->chipinfo.id == 0x4748) {
+        if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4716 ||
+            bus->chipinfo.id == BCMA_CHIP_ID_BCM4748) {
                pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
                pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
                                            BCMA_SOC_PCI_MEM_SZ - 1;
                pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
                                BCMA_CORE_PCI_SBTOPCI_MEM | BCMA_SOC_PCI_MEM);
-        } else if (bus->chipinfo.id == 0x5300) {
+        } else if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4706) {
                tmp = BCMA_CORE_PCI_SBTOPCI_MEM;
                tmp |= BCMA_CORE_PCI_SBTOPCI_PREF;
                tmp |= BCMA_CORE_PCI_SBTOPCI_BURST;
diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
index 6c05cf470f96..11b32d2642df 100644
--- a/drivers/bcma/host_pci.c
+++ b/drivers/bcma/host_pci.c
@@ -18,7 +18,7 @@ static void bcma_host_pci_switch_core(struct bcma_device *core)
        pci_write_config_dword(core->bus->host_pci, BCMA_PCI_BAR0_WIN2,
                               core->wrap);
        core->bus->mapped_core = core;
-        pr_debug("Switched to core: 0x%X\n", core->id.id);
+        bcma_debug(core->bus, "Switched to core: 0x%X\n", core->id.id);
 }
 /* Provides access to the requested core. Returns base offset that has to be
@@ -188,7 +188,7 @@ static int __devinit bcma_host_pci_probe(struct pci_dev *dev,
        /* SSB needed additional powering up, do we have any AMBA PCI cards? */
        if (!pci_is_pcie(dev))
-                pr_err("PCI card detected, report problems.\n");
+                bcma_err(bus, "PCI card detected, report problems.\n");
        /* Map MMIO */
        err = -ENOMEM;
@@ -268,6 +268,7 @@ static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bcma_host_pci_suspend,
 static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x0576) },
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43224) },
        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4331) },
        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4353) },
        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4357) },
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index 7e138ec21357..7ff4bac6f9e1 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -118,8 +118,9 @@ static int bcma_register_cores(struct bcma_bus *bus)
                err = device_register(&core->dev);
                if (err) {
-                        pr_err("Could not register dev for core 0x%03X\n",
+                        bcma_err(bus,
-                               core->id.id);
+                                 "Could not register dev for core 0x%03X\n",
+                                 core->id.id);
                        continue;
                }
                core->dev_registered = true;
@@ -151,7 +152,7 @@ int __devinit bcma_bus_register(struct bcma_bus *bus)
        /* Scan for devices (cores) */
        err = bcma_bus_scan(bus);
        if (err) {
-                pr_err("Failed to scan: %d\n", err);
+                bcma_err(bus, "Failed to scan: %d\n", err);
                return -1;
        }
@@ -179,14 +180,14 @@ int __devinit bcma_bus_register(struct bcma_bus *bus)
        /* Try to get SPROM */
        err = bcma_sprom_get(bus);
        if (err == -ENOENT) {
-                pr_err("No SPROM available\n");
+                bcma_err(bus, "No SPROM available\n");
        } else if (err)
-                pr_err("Failed to get SPROM: %d\n", err);
+                bcma_err(bus, "Failed to get SPROM: %d\n", err);
        /* Register found cores */
        bcma_register_cores(bus);
-        pr_info("Bus registered\n");
+        bcma_info(bus, "Bus registered\n");
        return 0;
 }
@@ -214,7 +215,7 @@ int __init bcma_bus_early_register(struct bcma_bus *bus,
        /* Scan for chip common core */
        err = bcma_bus_scan_early(bus, &match, core_cc);
        if (err) {
-                pr_err("Failed to scan for common core: %d\n", err);
+                bcma_err(bus, "Failed to scan for common core: %d\n", err);
                return -1;
        }
@@ -226,7 +227,7 @@ int __init bcma_bus_early_register(struct bcma_bus *bus,
        /* Scan for mips core */
        err = bcma_bus_scan_early(bus, &match, core_mips);
        if (err) {
-                pr_err("Failed to scan for mips core: %d\n", err);
+                bcma_err(bus, "Failed to scan for mips core: %d\n", err);
                return -1;
        }
@@ -244,7 +245,7 @@ int __init bcma_bus_early_register(struct bcma_bus *bus,
                bcma_core_mips_init(&bus->drv_mips);
        }
-        pr_info("Early bus registered\n");
+        bcma_info(bus, "Early bus registered\n");
        return 0;
 }
diff --git a/drivers/bcma/scan.c b/drivers/bcma/scan.c
index a3420585d942..a0272bbfc4f6 100644
--- a/drivers/bcma/scan.c
+++ b/drivers/bcma/scan.c
@@ -340,7 +340,7 @@ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
                if (tmp <= 0) {
                        return -EILSEQ;
                } else {
-                        pr_info("Bridge found\n");
+                        bcma_info(bus, "Bridge found\n");
                        return -ENXIO;
                }
        }
@@ -427,8 +427,8 @@ void bcma_init_bus(struct bcma_bus *bus)
        chipinfo->id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
        chipinfo->rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
        chipinfo->pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
-        pr_info("Found chip with id 0x%04X, rev 0x%02X and package 0x%02X\n",
+        bcma_info(bus, "Found chip with id 0x%04X, rev 0x%02X and package 0x%02X\n",
-                chipinfo->id, chipinfo->rev, chipinfo->pkg);
+                  chipinfo->id, chipinfo->rev, chipinfo->pkg);
        bus->init_done = true;
 }
@@ -482,11 +482,10 @@ int bcma_bus_scan(struct bcma_bus *bus)
                other_core = bcma_find_core_reverse(bus, core->id.id);
                core->core_unit = (other_core == NULL) ? 0 : other_core->core_unit + 1;
-                pr_info("Core %d found: %s "
+                bcma_info(bus, "Core %d found: %s (manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
-                        "(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
+                          core->core_index, bcma_device_name(&core->id),
-                        core->core_index, bcma_device_name(&core->id),
+                          core->id.manuf, core->id.id, core->id.rev,
-                        core->id.manuf, core->id.id, core->id.rev,
+                          core->id.class);
-                        core->id.class);
                list_add(&core->list, &bus->cores);
        }
@@ -538,11 +537,10 @@ int __init bcma_bus_scan_early(struct bcma_bus *bus,
                core->core_index = core_num++;
                bus->nr_cores++;
-                pr_info("Core %d found: %s "
+                bcma_info(bus, "Core %d found: %s (manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
-                        "(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
+                          core->core_index, bcma_device_name(&core->id),
-                        core->core_index, bcma_device_name(&core->id),
+                          core->id.manuf, core->id.id, core->id.rev,
-                        core->id.manuf, core->id.id, core->id.rev,
+                          core->id.class);
-                        core->id.class);
                list_add(&core->list, &bus->cores);
                err = 0;
diff --git a/drivers/bcma/sprom.c b/drivers/bcma/sprom.c
index f16f42d36071..26823d97fd9f 100644
--- a/drivers/bcma/sprom.c
+++ b/drivers/bcma/sprom.c
@@ -60,11 +60,11 @@ static int bcma_fill_sprom_with_fallback(struct bcma_bus *bus,
        if (err)
                goto fail;
-        pr_debug("Using SPROM revision %d provided by"
+        bcma_debug(bus, "Using SPROM revision %d provided by platform.\n",
-                 " platform.\n", bus->sprom.revision);
+                   bus->sprom.revision);
        return 0;
 fail:
-        pr_warn("Using fallback SPROM failed (err %d)\n", err);
+        bcma_warn(bus, "Using fallback SPROM failed (err %d)\n", err);
        return err;
 }
@@ -468,11 +468,11 @@ static bool bcma_sprom_ext_available(struct bcma_bus *bus)
        /* older chipcommon revisions use chip status register */
        chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
        switch (bus->chipinfo.id) {
-        case 0x4313:
+        case BCMA_CHIP_ID_BCM4313:
                present_mask = BCMA_CC_CHIPST_4313_SPROM_PRESENT;
                break;
-        case 0x4331:
+        case BCMA_CHIP_ID_BCM4331:
                present_mask = BCMA_CC_CHIPST_4331_SPROM_PRESENT;
                break;
@@ -494,16 +494,16 @@ static bool bcma_sprom_onchip_available(struct bcma_bus *bus)
        chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
        switch (bus->chipinfo.id) {
-        case 0x4313:
+        case BCMA_CHIP_ID_BCM4313:
                present = chip_status & BCMA_CC_CHIPST_4313_OTP_PRESENT;
                break;
-        case 0x4331:
+        case BCMA_CHIP_ID_BCM4331:
                present = chip_status & BCMA_CC_CHIPST_4331_OTP_PRESENT;
                break;
-        case 43224:
+        case BCMA_CHIP_ID_BCM43224:
-        case 43225:
+        case BCMA_CHIP_ID_BCM43225:
                /* for these chips OTP is always available */
                present = true;
                break;
@@ -579,13 +579,15 @@ int bcma_sprom_get(struct bcma_bus *bus)
        if (!sprom)
                return -ENOMEM;
-        if (bus->chipinfo.id == 0x4331 || bus->chipinfo.id == 43431)
+        if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4331 ||
+            bus->chipinfo.id == BCMA_CHIP_ID_BCM43431)
                bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, false);
-        pr_debug("SPROM offset 0x%x\n", offset);
+        bcma_debug(bus, "SPROM offset 0x%x\n", offset);
        bcma_sprom_read(bus, offset, sprom);
-        if (bus->chipinfo.id == 0x4331 || bus->chipinfo.id == 43431)
+        if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4331 ||
+            bus->chipinfo.id == BCMA_CHIP_ID_BCM43431)
                bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, true);
        err = bcma_sprom_valid(sprom);
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 2661f6e366f9..154f3ef07631 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -511,7 +511,6 @@ config USB_SWITCH_FSA9480
 source "drivers/misc/c2port/Kconfig"
 source "drivers/misc/eeprom/Kconfig"
 source "drivers/misc/cb710/Kconfig"
-source "drivers/misc/iwmc3200top/Kconfig"
 source "drivers/misc/ti-st/Kconfig"
 source "drivers/misc/lis3lv02d/Kconfig"
 source "drivers/misc/carma/Kconfig"
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 456972faaeb3..b88df7a350b8 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -36,7 +36,6 @@ obj-$(CONFIG_EP93XX_PWM)	+= ep93xx_pwm.o
 obj-$(CONFIG_DS1682)            += ds1682.o
 obj-$(CONFIG_TI_DAC7512)        += ti_dac7512.o
 obj-$(CONFIG_C2PORT)            += c2port/
-obj-$(CONFIG_IWMC3200TOP)      += iwmc3200top/
 obj-$(CONFIG_HMC6352)           += hmc6352.o
 obj-y                           += eeprom/
 obj-y                           += cb710/
diff --git a/drivers/misc/iwmc3200top/Kconfig b/drivers/misc/iwmc3200top/Kconfig
deleted file mode 100644
index 9e4b88fb57f1..000000000000
--- a/drivers/misc/iwmc3200top/Kconfig
+++ /dev/null
@@ -1,20 +0,0 @@
-config IWMC3200TOP
-        tristate "Intel Wireless MultiCom Top Driver"
-        depends on MMC && EXPERIMENTAL
-        select FW_LOADER
-        ---help---
-          Intel Wireless MultiCom 3200 Top driver is responsible for
-          for firmware load and enabled coms enumeration
-config IWMC3200TOP_DEBUG
-        bool "Enable full debug output of iwmc3200top Driver"
-        depends on IWMC3200TOP
-        ---help---
-          Enable full debug output of iwmc3200top Driver
-config IWMC3200TOP_DEBUGFS
-        bool "Enable Debugfs debugging interface for iwmc3200top"
-        depends on IWMC3200TOP
-        ---help---
-          Enable creation of debugfs files for iwmc3200top
diff --git a/drivers/misc/iwmc3200top/Makefile b/drivers/misc/iwmc3200top/Makefile
deleted file mode 100644
index fbf53fb4634e..000000000000
--- a/drivers/misc/iwmc3200top/Makefile
+++ /dev/null
@@ -1,29 +0,0 @@
-# iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
-# drivers/misc/iwmc3200top/Makefile
-#
-# Copyright (C) 2009 Intel Corporation. All rights reserved.
-#
-# This program is free software; you can redistribute it and/or
-# modify it under the terms of the GNU General Public License version
-# 2 as published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
-# 02110-1301, USA.
-#
-#
-# Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
-#  -
-#
-#
-obj-$(CONFIG_IWMC3200TOP)       += iwmc3200top.o
-iwmc3200top-objs        := main.o fw-download.o
-iwmc3200top-$(CONFIG_IWMC3200TOP_DEBUG) += log.o
-iwmc3200top-$(CONFIG_IWMC3200TOP_DEBUGFS) += debugfs.o
diff --git a/drivers/misc/iwmc3200top/debugfs.c b/drivers/misc/iwmc3200top/debugfs.c
deleted file mode 100644
index 62fbaec48207..000000000000
--- a/drivers/misc/iwmc3200top/debugfs.c
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
- * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
- * drivers/misc/iwmc3200top/debufs.c
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version
- * 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- *
- *
- * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
- *  -
- *
- */
-#include <linux/kernel.h>
-#include <linux/slab.h>
-#include <linux/string.h>
-#include <linux/ctype.h>
-#include <linux/mmc/sdio_func.h>
-#include <linux/mmc/sdio.h>
-#include <linux/debugfs.h>
-#include "iwmc3200top.h"
-#include "fw-msg.h"
-#include "log.h"
-#include "debugfs.h"
-/*      Constants definition        */
-#define HEXADECIMAL_RADIX       16
-/*      Functions definition        */
-#define DEBUGFS_ADD(name, parent) do {                                  \
-        dbgfs->dbgfs_##parent##_files.file_##name =                     \
-        debugfs_create_file(#name, 0644, dbgfs->dir_##parent, priv,     \
-                                &iwmct_dbgfs_##name##_ops);             \
-} while (0)
-#define DEBUGFS_RM(name)  do {          \
-        debugfs_remove(name);           \
-        name = NULL;                    \
-} while (0)
-#define DEBUGFS_READ_FUNC(name)                                         \
-ssize_t iwmct_dbgfs_##name##_read(struct file *file,                    \
-                                  char __user *user_buf,                \
-                                  size_t count, loff_t *ppos);
-#define DEBUGFS_WRITE_FUNC(name)                                        \
-ssize_t iwmct_dbgfs_##name##_write(struct file *file,                   \
-                                   const char __user *user_buf,         \
-                                   size_t count, loff_t *ppos);
-#define DEBUGFS_READ_FILE_OPS(name)                                     \
-        DEBUGFS_READ_FUNC(name)                                         \
-        static const struct file_operations iwmct_dbgfs_##name##_ops = {  \
-                .read = iwmct_dbgfs_##name##_read,                      \
-                .open = iwmct_dbgfs_open_file_generic,                  \
-                .llseek = generic_file_llseek,                          \
-        };
-#define DEBUGFS_WRITE_FILE_OPS(name)                                    \
-        DEBUGFS_WRITE_FUNC(name)                                        \
-        static const struct file_operations iwmct_dbgfs_##name##_ops = {  \
-                .write = iwmct_dbgfs_##name##_write,                    \
-                .open = iwmct_dbgfs_open_file_generic,                  \
-                .llseek = generic_file_llseek,                          \
-        };
-#define DEBUGFS_READ_WRITE_FILE_OPS(name)                               \
-        DEBUGFS_READ_FUNC(name)                                         \
-        DEBUGFS_WRITE_FUNC(name)                                        \
-        static const struct file_operations iwmct_dbgfs_##name##_ops = {\
-                .write = iwmct_dbgfs_##name##_write,                    \
-                .read = iwmct_dbgfs_##name##_read,                      \
-                .open = iwmct_dbgfs_open_file_generic,                  \
-                .llseek = generic_file_llseek,                          \
-        };
-/*      Debugfs file ops definitions        */
-/*
- * Create the debugfs files and directories
- *
- */
-void iwmct_dbgfs_register(struct iwmct_priv *priv, const char *name)
-{
-        struct iwmct_debugfs *dbgfs;
-        dbgfs = kzalloc(sizeof(struct iwmct_debugfs), GFP_KERNEL);
-        if (!dbgfs) {
-                LOG_ERROR(priv, DEBUGFS, "failed to allocate %zd bytes\n",
-                                        sizeof(struct iwmct_debugfs));
-                return;
-        }
-        priv->dbgfs = dbgfs;
-        dbgfs->name = name;
-        dbgfs->dir_drv = debugfs_create_dir(name, NULL);
-        if (!dbgfs->dir_drv) {
-                LOG_ERROR(priv, DEBUGFS, "failed to create debugfs dir\n");
-                return;
-        }
-        return;
-}
-/**
- * Remove the debugfs files and directories
- *
- */
-void iwmct_dbgfs_unregister(struct iwmct_debugfs *dbgfs)
-{
-        if (!dbgfs)
-                return;
-        DEBUGFS_RM(dbgfs->dir_drv);
-        kfree(dbgfs);
-        dbgfs = NULL;
-}
diff --git a/drivers/misc/iwmc3200top/debugfs.h b/drivers/misc/iwmc3200top/debugfs.h
deleted file mode 100644
index 71d45759b40f..000000000000
--- a/drivers/misc/iwmc3200top/debugfs.h
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
- * drivers/misc/iwmc3200top/debufs.h
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version
- * 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- *
- *
- * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
- *  -
- *
- */
-#ifndef __DEBUGFS_H__
-#define __DEBUGFS_H__
-#ifdef CONFIG_IWMC3200TOP_DEBUGFS
-struct iwmct_debugfs {
-        const char *name;
-        struct dentry *dir_drv;
-        struct dir_drv_files {
-        } dbgfs_drv_files;
-};
-void iwmct_dbgfs_register(struct iwmct_priv *priv, const char *name);
-void iwmct_dbgfs_unregister(struct iwmct_debugfs *dbgfs);
-#else /* CONFIG_IWMC3200TOP_DEBUGFS */
-struct iwmct_debugfs;
-static inline void
-iwmct_dbgfs_register(struct iwmct_priv *priv, const char *name)
-{}
-static inline void
-iwmct_dbgfs_unregister(struct iwmct_debugfs *dbgfs)
-{}
-#endif /* CONFIG_IWMC3200TOP_DEBUGFS */
-#endif /* __DEBUGFS_H__ */
diff --git a/drivers/misc/iwmc3200top/fw-download.c b/drivers/misc/iwmc3200top/fw-download.c
deleted file mode 100644
index e27afde6e99f..000000000000
--- a/drivers/misc/iwmc3200top/fw-download.c
+++ /dev/null
@@ -1,358 +0,0 @@
-/*
- * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
- * drivers/misc/iwmc3200top/fw-download.c
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version
- * 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- *
- *
- * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
- *  -
- *
- */
-#include <linux/firmware.h>
-#include <linux/mmc/sdio_func.h>
-#include <linux/slab.h>
-#include <asm/unaligned.h>
-#include "iwmc3200top.h"
-#include "log.h"
-#include "fw-msg.h"
-#define CHECKSUM_BYTES_NUM sizeof(u32)
-/**
-  init parser struct with file
- */
-static int iwmct_fw_parser_init(struct iwmct_priv *priv, const u8 *file,
-                              size_t file_size, size_t block_size)
-{
-        struct iwmct_parser *parser = &priv->parser;
-        struct iwmct_fw_hdr *fw_hdr = &parser->versions;
-        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
-        LOG_INFO(priv, FW_DOWNLOAD, "file_size=%zd\n", file_size);
-        parser->file = file;
-        parser->file_size = file_size;
-        parser->cur_pos = 0;
-        parser->entry_point = 0;
-        parser->buf = kzalloc(block_size, GFP_KERNEL);
-        if (!parser->buf) {
-                LOG_ERROR(priv, FW_DOWNLOAD, "kzalloc error\n");
-                return -ENOMEM;
-        }
-        parser->buf_size = block_size;
-        /* extract fw versions */
-        memcpy(fw_hdr, parser->file, sizeof(struct iwmct_fw_hdr));
-        LOG_INFO(priv, FW_DOWNLOAD, "fw versions are:\n"
-                "top %u.%u.%u gps %u.%u.%u bt %u.%u.%u tic %s\n",
-                fw_hdr->top_major, fw_hdr->top_minor, fw_hdr->top_revision,
-                fw_hdr->gps_major, fw_hdr->gps_minor, fw_hdr->gps_revision,
-                fw_hdr->bt_major, fw_hdr->bt_minor, fw_hdr->bt_revision,
-                fw_hdr->tic_name);
-        parser->cur_pos += sizeof(struct iwmct_fw_hdr);
-        LOG_TRACE(priv, FW_DOWNLOAD, "<--\n");
-        return 0;
-}
-static bool iwmct_checksum(struct iwmct_priv *priv)
-{
-        struct iwmct_parser *parser = &priv->parser;
-        __le32 *file = (__le32 *)parser->file;
-        int i, pad, steps;
-        u32 accum = 0;
-        u32 checksum;
-        u32 mask = 0xffffffff;
-        pad = (parser->file_size - CHECKSUM_BYTES_NUM) % 4;
-        steps =  (parser->file_size - CHECKSUM_BYTES_NUM) / 4;
-        LOG_INFO(priv, FW_DOWNLOAD, "pad=%d steps=%d\n", pad, steps);
-        for (i = 0; i < steps; i++)
-                accum += le32_to_cpu(file[i]);
-        if (pad) {
-                mask <<= 8 * (4 - pad);
-                accum += le32_to_cpu(file[steps]) & mask;
-        }
-        checksum = get_unaligned_le32((__le32 *)(parser->file +
-                        parser->file_size - CHECKSUM_BYTES_NUM));
-        LOG_INFO(priv, FW_DOWNLOAD,
-                "compare checksum accum=0x%x to checksum=0x%x\n",
-                accum, checksum);
-        return checksum == accum;
-}
-static int iwmct_parse_next_section(struct iwmct_priv *priv, const u8 **p_sec,
-                                  size_t *sec_size, __le32 *sec_addr)
-{
-        struct iwmct_parser *parser = &priv->parser;
-        struct iwmct_dbg *dbg = &priv->dbg;
-        struct iwmct_fw_sec_hdr *sec_hdr;
-        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
-        while (parser->cur_pos + sizeof(struct iwmct_fw_sec_hdr)
-                <= parser->file_size) {
-                sec_hdr = (struct iwmct_fw_sec_hdr *)
-                                (parser->file + parser->cur_pos);
-                parser->cur_pos += sizeof(struct iwmct_fw_sec_hdr);
-                LOG_INFO(priv, FW_DOWNLOAD,
-                        "sec hdr: type=%s addr=0x%x size=%d\n",
-                        sec_hdr->type, sec_hdr->target_addr,
-                        sec_hdr->data_size);
-                if (strcmp(sec_hdr->type, "ENT") == 0)
-                        parser->entry_point = le32_to_cpu(sec_hdr->target_addr);
-                else if (strcmp(sec_hdr->type, "LBL") == 0)
-                        strcpy(dbg->label_fw, parser->file + parser->cur_pos);
-                else if (((strcmp(sec_hdr->type, "TOP") == 0) &&
-                          (priv->barker & BARKER_DNLOAD_TOP_MSK)) ||
-                         ((strcmp(sec_hdr->type, "GPS") == 0) &&
-                          (priv->barker & BARKER_DNLOAD_GPS_MSK)) ||
-                         ((strcmp(sec_hdr->type, "BTH") == 0) &&
-                          (priv->barker & BARKER_DNLOAD_BT_MSK))) {
-                        *sec_addr = sec_hdr->target_addr;
-                        *sec_size = le32_to_cpu(sec_hdr->data_size);
-                        *p_sec = parser->file + parser->cur_pos;
-                        parser->cur_pos += le32_to_cpu(sec_hdr->data_size);
-                        return 1;
-                } else if (strcmp(sec_hdr->type, "LOG") != 0)
-                        LOG_WARNING(priv, FW_DOWNLOAD,
-                                    "skipping section type %s\n",
-                                    sec_hdr->type);
-                parser->cur_pos += le32_to_cpu(sec_hdr->data_size);
-                LOG_INFO(priv, FW_DOWNLOAD,
-                        "finished with section cur_pos=%zd\n", parser->cur_pos);
-        }
-        LOG_TRACE(priv, INIT, "<--\n");
-        return 0;
-}
-static int iwmct_download_section(struct iwmct_priv *priv, const u8 *p_sec,
-                                size_t sec_size, __le32 addr)
-{
-        struct iwmct_parser *parser = &priv->parser;
-        struct iwmct_fw_load_hdr *hdr = (struct iwmct_fw_load_hdr *)parser->buf;
-        const u8 *cur_block = p_sec;
-        size_t sent = 0;
-        int cnt = 0;
-        int ret = 0;
-        u32 cmd = 0;
-        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
-        LOG_INFO(priv, FW_DOWNLOAD, "Download address 0x%x size 0x%zx\n",
-                                addr, sec_size);
-        while (sent < sec_size) {
-                int i;
-                u32 chksm = 0;
-                u32 reset = atomic_read(&priv->reset);
-                /* actual FW data */
-                u32 data_size = min(parser->buf_size - sizeof(*hdr),
-                                    sec_size - sent);
-                /* Pad to block size */
-                u32 trans_size = (data_size + sizeof(*hdr) +
-                                  IWMC_SDIO_BLK_SIZE - 1) &
-                                  ~(IWMC_SDIO_BLK_SIZE - 1);
-                ++cnt;
-                /* in case of reset, interrupt FW DOWNLAOD */
-                if (reset) {
-                        LOG_INFO(priv, FW_DOWNLOAD,
-                                 "Reset detected. Abort FW download!!!");
-                        ret = -ECANCELED;
-                        goto exit;
-                }
-                memset(parser->buf, 0, parser->buf_size);
-                cmd |= IWMC_OPCODE_WRITE << CMD_HDR_OPCODE_POS;
-                cmd |= IWMC_CMD_SIGNATURE << CMD_HDR_SIGNATURE_POS;
-                cmd |= (priv->dbg.direct ? 1 : 0) << CMD_HDR_DIRECT_ACCESS_POS;
-                cmd |= (priv->dbg.checksum ? 1 : 0) << CMD_HDR_USE_CHECKSUM_POS;
-                hdr->data_size = cpu_to_le32(data_size);
-                hdr->target_addr = addr;
-                /* checksum is allowed for sizes divisible by 4 */
-                if (data_size & 0x3)
-                        cmd &= ~CMD_HDR_USE_CHECKSUM_MSK;
-                memcpy(hdr->data, cur_block, data_size);
-                if (cmd & CMD_HDR_USE_CHECKSUM_MSK) {
-                        chksm = data_size + le32_to_cpu(addr) + cmd;
-                        for (i = 0; i < data_size >> 2; i++)
-                                chksm += ((u32 *)cur_block)[i];
-                        hdr->block_chksm = cpu_to_le32(chksm);
-                        LOG_INFO(priv, FW_DOWNLOAD, "Checksum = 0x%X\n",
-                                 hdr->block_chksm);
-                }
-                LOG_INFO(priv, FW_DOWNLOAD, "trans#%d, len=%d, sent=%zd, "
-                                "sec_size=%zd, startAddress 0x%X\n",
-                                cnt, trans_size, sent, sec_size, addr);
-                if (priv->dbg.dump)
-                        LOG_HEXDUMP(FW_DOWNLOAD, parser->buf, trans_size);
-                hdr->cmd = cpu_to_le32(cmd);
-                /* send it down */
-                /* TODO: add more proper sending and error checking */
-                ret = iwmct_tx(priv, parser->buf, trans_size);
-                if (ret != 0) {
-                        LOG_INFO(priv, FW_DOWNLOAD,
-                                "iwmct_tx returned %d\n", ret);
-                        goto exit;
-                }
-                addr = cpu_to_le32(le32_to_cpu(addr) + data_size);
-                sent += data_size;
-                cur_block = p_sec + sent;
-                if (priv->dbg.blocks && (cnt + 1) >= priv->dbg.blocks) {
-                        LOG_INFO(priv, FW_DOWNLOAD,
-                                "Block number limit is reached [%d]\n",
-                                priv->dbg.blocks);
-                        break;
-                }
-        }
-        if (sent < sec_size)
-                ret = -EINVAL;
-exit:
-        LOG_TRACE(priv, FW_DOWNLOAD, "<--\n");
-        return ret;
-}
-static int iwmct_kick_fw(struct iwmct_priv *priv, bool jump)
-{
-        struct iwmct_parser *parser = &priv->parser;
-        struct iwmct_fw_load_hdr *hdr = (struct iwmct_fw_load_hdr *)parser->buf;
-        int ret;
-        u32 cmd;
-        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
-        memset(parser->buf, 0, parser->buf_size);
-        cmd = IWMC_CMD_SIGNATURE << CMD_HDR_SIGNATURE_POS;
-        if (jump) {
-                cmd |= IWMC_OPCODE_JUMP << CMD_HDR_OPCODE_POS;
-                hdr->target_addr = cpu_to_le32(parser->entry_point);
-                LOG_INFO(priv, FW_DOWNLOAD, "jump address 0x%x\n",
-                                parser->entry_point);
-        } else {
-                cmd |= IWMC_OPCODE_LAST_COMMAND << CMD_HDR_OPCODE_POS;
-                LOG_INFO(priv, FW_DOWNLOAD, "last command\n");
-        }
-        hdr->cmd = cpu_to_le32(cmd);
-        LOG_HEXDUMP(FW_DOWNLOAD, parser->buf, sizeof(*hdr));
-        /* send it down */
-        /* TODO: add more proper sending and error checking */
-        ret = iwmct_tx(priv, parser->buf, IWMC_SDIO_BLK_SIZE);
-        if (ret)
-                LOG_INFO(priv, FW_DOWNLOAD, "iwmct_tx returned %d", ret);
-        LOG_TRACE(priv, FW_DOWNLOAD, "<--\n");
-        return 0;
-}
-int iwmct_fw_load(struct iwmct_priv *priv)
-{
-        const u8 *fw_name = FW_NAME(FW_API_VER);
-        const struct firmware *raw;
-        const u8 *pdata;
-        size_t len;
-        __le32 addr;
-        int ret;
-        LOG_INFO(priv, FW_DOWNLOAD, "barker download request 0x%x is:\n",
-                        priv->barker);
-        LOG_INFO(priv, FW_DOWNLOAD, "*******  Top FW %s requested ********\n",
-                        (priv->barker & BARKER_DNLOAD_TOP_MSK) ? "was" : "not");
-        LOG_INFO(priv, FW_DOWNLOAD, "*******  GPS FW %s requested ********\n",
-                        (priv->barker & BARKER_DNLOAD_GPS_MSK) ? "was" : "not");
-        LOG_INFO(priv, FW_DOWNLOAD, "*******  BT FW %s requested ********\n",
-                        (priv->barker & BARKER_DNLOAD_BT_MSK) ? "was" : "not");
-        /* get the firmware */
-        ret = request_firmware(&raw, fw_name, &priv->func->dev);
-        if (ret < 0) {
-                LOG_ERROR(priv, FW_DOWNLOAD, "%s request_firmware failed %d\n",
-                          fw_name, ret);
-                goto exit;
-        }
-        if (raw->size < sizeof(struct iwmct_fw_sec_hdr)) {
-                LOG_ERROR(priv, FW_DOWNLOAD, "%s smaller then (%zd) (%zd)\n",
-                          fw_name, sizeof(struct iwmct_fw_sec_hdr), raw->size);
-                goto exit;
-        }
-        LOG_INFO(priv, FW_DOWNLOAD, "Read firmware '%s'\n", fw_name);
-        /* clear parser struct */
-        ret = iwmct_fw_parser_init(priv, raw->data, raw->size, priv->trans_len);
-        if (ret < 0) {
-                LOG_ERROR(priv, FW_DOWNLOAD,
-                          "iwmct_parser_init failed: Reason %d\n", ret);
-                goto exit;
-        }
-        if (!iwmct_checksum(priv)) {
-                LOG_ERROR(priv, FW_DOWNLOAD, "checksum error\n");
-                ret = -EINVAL;
-                goto exit;
-        }
-        /* download firmware to device */
-        while (iwmct_parse_next_section(priv, &pdata, &len, &addr)) {
-                ret = iwmct_download_section(priv, pdata, len, addr);
-                if (ret) {
-                        LOG_ERROR(priv, FW_DOWNLOAD,
-                                  "%s download section failed\n", fw_name);
-                        goto exit;
-                }
-        }
-        ret = iwmct_kick_fw(priv, !!(priv->barker & BARKER_DNLOAD_JUMP_MSK));
-exit:
-        kfree(priv->parser.buf);
-        release_firmware(raw);
-        return ret;
-}
diff --git a/drivers/misc/iwmc3200top/fw-msg.h b/drivers/misc/iwmc3200top/fw-msg.h
deleted file mode 100644
index 9e26b75bd482..000000000000
--- a/drivers/misc/iwmc3200top/fw-msg.h
+++ /dev/null
@@ -1,113 +0,0 @@
-/*
- * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
- * drivers/misc/iwmc3200top/fw-msg.h
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version
- * 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- *
- *
- * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
- *  -
- *
- */
-#ifndef __FWMSG_H__
-#define __FWMSG_H__
-#define COMM_TYPE_D2H                   0xFF
-#define COMM_TYPE_H2D                   0xEE
-#define COMM_CATEGORY_OPERATIONAL       0x00
-#define COMM_CATEGORY_DEBUG             0x01
-#define COMM_CATEGORY_TESTABILITY       0x02
-#define COMM_CATEGORY_DIAGNOSTICS       0x03
-#define OP_DBG_ZSTR_MSG                 cpu_to_le16(0x1A)
-#define FW_LOG_SRC_MAX                  32
-#define FW_LOG_SRC_ALL                  255
-#define FW_STRING_TABLE_ADDR            cpu_to_le32(0x0C000000)
-#define CMD_DBG_LOG_LEVEL               cpu_to_le16(0x0001)
-#define CMD_TST_DEV_RESET               cpu_to_le16(0x0060)
-#define CMD_TST_FUNC_RESET              cpu_to_le16(0x0062)
-#define CMD_TST_IFACE_RESET             cpu_to_le16(0x0064)
-#define CMD_TST_CPU_UTILIZATION         cpu_to_le16(0x0065)
-#define CMD_TST_TOP_DEEP_SLEEP          cpu_to_le16(0x0080)
-#define CMD_TST_WAKEUP                  cpu_to_le16(0x0081)
-#define CMD_TST_FUNC_WAKEUP             cpu_to_le16(0x0082)
-#define CMD_TST_FUNC_DEEP_SLEEP_REQUEST cpu_to_le16(0x0083)
-#define CMD_TST_GET_MEM_DUMP            cpu_to_le16(0x0096)
-#define OP_OPR_ALIVE                    cpu_to_le16(0x0010)
-#define OP_OPR_CMD_ACK                  cpu_to_le16(0x001F)
-#define OP_OPR_CMD_NACK                 cpu_to_le16(0x0020)
-#define OP_TST_MEM_DUMP                 cpu_to_le16(0x0043)
-#define CMD_FLAG_PADDING_256            0x80
-#define FW_HCMD_BLOCK_SIZE              256
-struct msg_hdr {
-        u8 type;
-        u8 category;
-        __le16 opcode;
-        u8 seqnum;
-        u8 flags;
-        __le16 length;
-} __attribute__((__packed__));
-struct log_hdr {
-        __le32 timestamp;
-        u8 severity;
-        u8 logsource;
-        __le16 reserved;
-} __attribute__((__packed__));
-struct mdump_hdr {
-        u8 dmpid;
-        u8 frag;
-        __le16 size;
-        __le32 addr;
-} __attribute__((__packed__));
-struct top_msg {
-        struct msg_hdr hdr;
-        union {
-                /* D2H messages */
-                struct {
-                        struct log_hdr log_hdr;
-                        u8 data[1];
-                } __attribute__((__packed__)) log;
-                struct {
-                        struct log_hdr log_hdr;
-                        struct mdump_hdr md_hdr;
-                        u8 data[1];
-                } __attribute__((__packed__)) mdump;
-                /* H2D messages */
-                struct {
-                        u8 logsource;
-                        u8 sevmask;
-                } __attribute__((__packed__)) logdefs[FW_LOG_SRC_MAX];
-                struct mdump_hdr mdump_req;
-        } u;
-} __attribute__((__packed__));
-#endif /* __FWMSG_H__ */
diff --git a/drivers/misc/iwmc3200top/iwmc3200top.h b/drivers/misc/iwmc3200top/iwmc3200top.h
deleted file mode 100644
index 620973ed8bf9..000000000000
--- a/drivers/misc/iwmc3200top/iwmc3200top.h
+++ /dev/null
@@ -1,205 +0,0 @@
-/*
- * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
- * drivers/misc/iwmc3200top/iwmc3200top.h
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version
- * 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- *
- *
- * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
- *  -
- *
- */
-#ifndef __IWMC3200TOP_H__
-#define __IWMC3200TOP_H__
-#include <linux/workqueue.h>
-#define DRV_NAME "iwmc3200top"
-#define FW_API_VER 1
-#define _FW_NAME(api) DRV_NAME "." #api ".fw"
-#define FW_NAME(api) _FW_NAME(api)
-#define IWMC_SDIO_BLK_SIZE                      256
-#define IWMC_DEFAULT_TR_BLK                     64
-#define IWMC_SDIO_DATA_ADDR                     0x0
-#define IWMC_SDIO_INTR_ENABLE_ADDR              0x14
-#define IWMC_SDIO_INTR_STATUS_ADDR              0x13
-#define IWMC_SDIO_INTR_CLEAR_ADDR               0x13
-#define IWMC_SDIO_INTR_GET_SIZE_ADDR            0x2C
-#define COMM_HUB_HEADER_LENGTH 16
-#define LOGGER_HEADER_LENGTH   10
-#define BARKER_DNLOAD_BT_POS            0
-#define BARKER_DNLOAD_BT_MSK            BIT(BARKER_DNLOAD_BT_POS)
-#define BARKER_DNLOAD_GPS_POS           1
-#define BARKER_DNLOAD_GPS_MSK           BIT(BARKER_DNLOAD_GPS_POS)
-#define BARKER_DNLOAD_TOP_POS           2
-#define BARKER_DNLOAD_TOP_MSK           BIT(BARKER_DNLOAD_TOP_POS)
-#define BARKER_DNLOAD_RESERVED1_POS     3
-#define BARKER_DNLOAD_RESERVED1_MSK     BIT(BARKER_DNLOAD_RESERVED1_POS)
-#define BARKER_DNLOAD_JUMP_POS          4
-#define BARKER_DNLOAD_JUMP_MSK          BIT(BARKER_DNLOAD_JUMP_POS)
-#define BARKER_DNLOAD_SYNC_POS          5
-#define BARKER_DNLOAD_SYNC_MSK          BIT(BARKER_DNLOAD_SYNC_POS)
-#define BARKER_DNLOAD_RESERVED2_POS     6
-#define BARKER_DNLOAD_RESERVED2_MSK     (0x3 << BARKER_DNLOAD_RESERVED2_POS)
-#define BARKER_DNLOAD_BARKER_POS        8
-#define BARKER_DNLOAD_BARKER_MSK        (0xffffff << BARKER_DNLOAD_BARKER_POS)
-#define IWMC_BARKER_REBOOT      (0xdeadbe << BARKER_DNLOAD_BARKER_POS)
-/* whole field barker */
-#define IWMC_BARKER_ACK         0xfeedbabe
-#define IWMC_CMD_SIGNATURE      0xcbbc
-#define CMD_HDR_OPCODE_POS              0
-#define CMD_HDR_OPCODE_MSK_MSK          (0xf << CMD_HDR_OPCODE_MSK_POS)
-#define CMD_HDR_RESPONSE_CODE_POS       4
-#define CMD_HDR_RESPONSE_CODE_MSK       (0xf << CMD_HDR_RESPONSE_CODE_POS)
-#define CMD_HDR_USE_CHECKSUM_POS        8
-#define CMD_HDR_USE_CHECKSUM_MSK        BIT(CMD_HDR_USE_CHECKSUM_POS)
-#define CMD_HDR_RESPONSE_REQUIRED_POS   9
-#define CMD_HDR_RESPONSE_REQUIRED_MSK   BIT(CMD_HDR_RESPONSE_REQUIRED_POS)
-#define CMD_HDR_DIRECT_ACCESS_POS       10
-#define CMD_HDR_DIRECT_ACCESS_MSK       BIT(CMD_HDR_DIRECT_ACCESS_POS)
-#define CMD_HDR_RESERVED_POS            11
-#define CMD_HDR_RESERVED_MSK            BIT(0x1f << CMD_HDR_RESERVED_POS)
-#define CMD_HDR_SIGNATURE_POS           16
-#define CMD_HDR_SIGNATURE_MSK           BIT(0xffff << CMD_HDR_SIGNATURE_POS)
-enum {
-        IWMC_OPCODE_PING = 0,
-        IWMC_OPCODE_READ = 1,
-        IWMC_OPCODE_WRITE = 2,
-        IWMC_OPCODE_JUMP = 3,
-        IWMC_OPCODE_REBOOT = 4,
-        IWMC_OPCODE_PERSISTENT_WRITE = 5,
-        IWMC_OPCODE_PERSISTENT_READ = 6,
-        IWMC_OPCODE_READ_MODIFY_WRITE = 7,
-        IWMC_OPCODE_LAST_COMMAND = 15
-};
-struct iwmct_fw_load_hdr {
-        __le32 cmd;
-        __le32 target_addr;
-        __le32 data_size;
-        __le32 block_chksm;
-        u8 data[0];
-};
-/**
- * struct iwmct_fw_hdr
- * holds all sw components versions
- */
-struct iwmct_fw_hdr {
-        u8 top_major;
-        u8 top_minor;
-        u8 top_revision;
-        u8 gps_major;
-        u8 gps_minor;
-        u8 gps_revision;
-        u8 bt_major;
-        u8 bt_minor;
-        u8 bt_revision;
-        u8 tic_name[31];
-};
-/**
- * struct iwmct_fw_sec_hdr
- * @type: function type
- * @data_size: section's data size
- * @target_addr: download address
- */
-struct iwmct_fw_sec_hdr {
-        u8 type[4];
-        __le32 data_size;
-        __le32 target_addr;
-};
-/**
- * struct iwmct_parser
- * @file: fw image
- * @file_size: fw size
- * @cur_pos: position in file
- * @buf: temp buf for download
- * @buf_size: size of buf
- * @entry_point: address to jump in fw kick-off
- */
-struct iwmct_parser {
-        const u8 *file;
-        size_t file_size;
-        size_t cur_pos;
-        u8 *buf;
-        size_t buf_size;
-        u32 entry_point;
-        struct iwmct_fw_hdr versions;
-};
-struct iwmct_work_struct {
-        struct list_head list;
-        ssize_t iosize;
-};
-struct iwmct_dbg {
-        int blocks;
-        bool dump;
-        bool jump;
-        bool direct;
-        bool checksum;
-        bool fw_download;
-        int block_size;
-        int download_trans_blks;
-        char label_fw[256];
-};
-struct iwmct_debugfs;
-struct iwmct_priv {
-        struct sdio_func *func;
-        struct iwmct_debugfs *dbgfs;
-        struct iwmct_parser parser;
-        atomic_t reset;
-        atomic_t dev_sync;
-        u32 trans_len;
-        u32 barker;
-        struct iwmct_dbg dbg;
-        /* drivers work items */
-        struct work_struct bus_rescan_worker;
-        struct work_struct isr_worker;
-        /* drivers wait queue */
-        wait_queue_head_t wait_q;
-        /* rx request list */
-        struct list_head read_req_list;
-};
-extern int iwmct_tx(struct iwmct_priv *priv, void *src, int count);
-extern int iwmct_fw_load(struct iwmct_priv *priv);
-extern void iwmct_dbg_init_params(struct iwmct_priv *drv);
-extern void iwmct_dbg_init_drv_attrs(struct device_driver *drv);
-extern void iwmct_dbg_remove_drv_attrs(struct device_driver *drv);
-extern int iwmct_send_hcmd(struct iwmct_priv *priv, u8 *cmd, u16 len);
-#endif  /*  __IWMC3200TOP_H__  */
diff --git a/drivers/misc/iwmc3200top/log.c b/drivers/misc/iwmc3200top/log.c
deleted file mode 100644
index a36a55a49cac..000000000000
--- a/drivers/misc/iwmc3200top/log.c
+++ /dev/null
@@ -1,348 +0,0 @@
-/*
- * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
- * drivers/misc/iwmc3200top/log.c
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version
- * 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- *
- *
- * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
- *  -
- *
- */
-#include <linux/kernel.h>
-#include <linux/mmc/sdio_func.h>
-#include <linux/slab.h>
-#include <linux/ctype.h>
-#include "fw-msg.h"
-#include "iwmc3200top.h"
-#include "log.h"
-/* Maximal hexadecimal string size of the FW memdump message */
-#define LOG_MSG_SIZE_MAX                12400
-/* iwmct_logdefs is a global used by log macros */
-u8 iwmct_logdefs[LOG_SRC_MAX];
-static u8 iwmct_fw_logdefs[FW_LOG_SRC_MAX];
-static int _log_set_log_filter(u8 *logdefs, int size, u8 src, u8 logmask)
-{
-        int i;
-        if (src < size)
-                logdefs[src] = logmask;
-        else if (src == LOG_SRC_ALL)
-                for (i = 0; i < size; i++)
-                        logdefs[i] = logmask;
-        else
-                return -1;
-        return 0;
-}
-int iwmct_log_set_filter(u8 src, u8 logmask)
-{
-        return _log_set_log_filter(iwmct_logdefs, LOG_SRC_MAX, src, logmask);
-}
-int iwmct_log_set_fw_filter(u8 src, u8 logmask)
-{
-        return _log_set_log_filter(iwmct_fw_logdefs,
-                                   FW_LOG_SRC_MAX, src, logmask);
-}
-static int log_msg_format_hex(char *str, int slen, u8 *ibuf,
-                              int ilen, char *pref)
-{
-        int pos = 0;
-        int i;
-        int len;
-        for (pos = 0, i = 0; pos < slen - 2 && pref[i] != '\0'; i++, pos++)
-                str[pos] = pref[i];
-        for (i = 0; pos < slen - 2 && i < ilen; pos += len, i++)
-                len = snprintf(&str[pos], slen - pos - 1, " %2.2X", ibuf[i]);
-        if (i < ilen)
-                return -1;
-        return 0;
-}
-/*      NOTE: This function is not thread safe.
-        Currently it's called only from sdio rx worker - no race there
-*/
-void iwmct_log_top_message(struct iwmct_priv *priv, u8 *buf, int len)
-{
-        struct top_msg *msg;
-        static char logbuf[LOG_MSG_SIZE_MAX];
-        msg = (struct top_msg *)buf;
-        if (len < sizeof(msg->hdr) + sizeof(msg->u.log.log_hdr)) {
-                LOG_ERROR(priv, FW_MSG, "Log message from TOP "
-                          "is too short %d (expected %zd)\n",
-                          len, sizeof(msg->hdr) + sizeof(msg->u.log.log_hdr));
-                return;
-        }
-        if (!(iwmct_fw_logdefs[msg->u.log.log_hdr.logsource] &
-                BIT(msg->u.log.log_hdr.severity)) ||
-            !(iwmct_logdefs[LOG_SRC_FW_MSG] & BIT(msg->u.log.log_hdr.severity)))
-                return;
-        switch (msg->hdr.category) {
-        case COMM_CATEGORY_TESTABILITY:
-                if (!(iwmct_logdefs[LOG_SRC_TST] &
-                      BIT(msg->u.log.log_hdr.severity)))
-                        return;
-                if (log_msg_format_hex(logbuf, LOG_MSG_SIZE_MAX, buf,
-                                       le16_to_cpu(msg->hdr.length) +
-                                       sizeof(msg->hdr), "<TST>"))
-                        LOG_WARNING(priv, TST,
-                                  "TOP TST message is too long, truncating...");
-                LOG_WARNING(priv, TST, "%s\n", logbuf);
-                break;
-        case COMM_CATEGORY_DEBUG:
-                if (msg->hdr.opcode == OP_DBG_ZSTR_MSG)
-                        LOG_INFO(priv, FW_MSG, "%s %s", "<DBG>",
-                                       ((u8 *)msg) + sizeof(msg->hdr)
-                                        + sizeof(msg->u.log.log_hdr));
-                else {
-                        if (log_msg_format_hex(logbuf, LOG_MSG_SIZE_MAX, buf,
-                                        le16_to_cpu(msg->hdr.length)
-                                                + sizeof(msg->hdr),
-                                        "<DBG>"))
-                                LOG_WARNING(priv, FW_MSG,
-                                        "TOP DBG message is too long,"
-                                        "truncating...");
-                        LOG_WARNING(priv, FW_MSG, "%s\n", logbuf);
-                }
-                break;
-        default:
-                break;
-        }
-}
-static int _log_get_filter_str(u8 *logdefs, int logdefsz, char *buf, int size)
-{
-        int i, pos, len;
-        for (i = 0, pos = 0; (pos < size-1) && (i < logdefsz); i++) {
-                len = snprintf(&buf[pos], size - pos - 1, "0x%02X%02X,",
-                                i, logdefs[i]);
-                pos += len;
-        }
-        buf[pos-1] = '\n';
-        buf[pos] = '\0';
-        if (i < logdefsz)
-                return -1;
-        return 0;
-}
-int log_get_filter_str(char *buf, int size)
-{
-        return _log_get_filter_str(iwmct_logdefs, LOG_SRC_MAX, buf, size);
-}
-int log_get_fw_filter_str(char *buf, int size)
-{
-        return _log_get_filter_str(iwmct_fw_logdefs, FW_LOG_SRC_MAX, buf, size);
-}
-#define HEXADECIMAL_RADIX       16
-#define LOG_SRC_FORMAT          7 /* log level is in format of "0xXXXX," */
-ssize_t show_iwmct_log_level(struct device *d,
-                                struct device_attribute *attr, char *buf)
-{
-        struct iwmct_priv *priv = dev_get_drvdata(d);
-        char *str_buf;
-        int buf_size;
-        ssize_t ret;
-        buf_size = (LOG_SRC_FORMAT * LOG_SRC_MAX) + 1;
-        str_buf = kzalloc(buf_size, GFP_KERNEL);
-        if (!str_buf) {
-                LOG_ERROR(priv, DEBUGFS,
-                        "failed to allocate %d bytes\n", buf_size);
-                ret = -ENOMEM;
-                goto exit;
-        }
-        if (log_get_filter_str(str_buf, buf_size) < 0) {
-                ret = -EINVAL;
-                goto exit;
-        }
-        ret = sprintf(buf, "%s", str_buf);
-exit:
-        kfree(str_buf);
-        return ret;
-}
-ssize_t store_iwmct_log_level(struct device *d,
-                        struct device_attribute *attr,
-                        const char *buf, size_t count)
-{
-        struct iwmct_priv *priv = dev_get_drvdata(d);
-        char *token, *str_buf = NULL;
-        long val;
-        ssize_t ret = count;
-        u8 src, mask;
-        if (!count)
-                goto exit;
-        str_buf = kzalloc(count, GFP_KERNEL);
-        if (!str_buf) {
-                LOG_ERROR(priv, DEBUGFS,
-                        "failed to allocate %zd bytes\n", count);
-                ret = -ENOMEM;
-                goto exit;
-        }
-        memcpy(str_buf, buf, count);
-        while ((token = strsep(&str_buf, ",")) != NULL) {
-                while (isspace(*token))
-                        ++token;
-                if (strict_strtol(token, HEXADECIMAL_RADIX, &val)) {
-                        LOG_ERROR(priv, DEBUGFS,
-                                  "failed to convert string to long %s\n",
-                                  token);
-                        ret = -EINVAL;
-                        goto exit;
-                }
-                mask  = val & 0xFF;
-                src = (val & 0XFF00) >> 8;
-                iwmct_log_set_filter(src, mask);
-        }
-exit:
-        kfree(str_buf);
-        return ret;
-}
-ssize_t show_iwmct_log_level_fw(struct device *d,
-                        struct device_attribute *attr, char *buf)
-{
-        struct iwmct_priv *priv = dev_get_drvdata(d);
-        char *str_buf;
-        int buf_size;
-        ssize_t ret;
-        buf_size = (LOG_SRC_FORMAT * FW_LOG_SRC_MAX) + 2;
-        str_buf = kzalloc(buf_size, GFP_KERNEL);
-        if (!str_buf) {
-                LOG_ERROR(priv, DEBUGFS,
-                        "failed to allocate %d bytes\n", buf_size);
-                ret = -ENOMEM;
-                goto exit;
-        }
-        if (log_get_fw_filter_str(str_buf, buf_size) < 0) {
-                ret = -EINVAL;
-                goto exit;
-        }
-        ret = sprintf(buf, "%s", str_buf);
-exit:
-        kfree(str_buf);
-        return ret;
-}
-ssize_t store_iwmct_log_level_fw(struct device *d,
-                        struct device_attribute *attr,
-                        const char *buf, size_t count)
-{
-        struct iwmct_priv *priv = dev_get_drvdata(d);
-        struct top_msg cmd;
-        char *token, *str_buf = NULL;
-        ssize_t ret = count;
-        u16 cmdlen = 0;
-        int i;
-        long val;
-        u8 src, mask;
-        if (!count)
-                goto exit;
-        str_buf = kzalloc(count, GFP_KERNEL);
-        if (!str_buf) {
-                LOG_ERROR(priv, DEBUGFS,
-                        "failed to allocate %zd bytes\n", count);
-                ret = -ENOMEM;
-                goto exit;
-        }
-        memcpy(str_buf, buf, count);
-        cmd.hdr.type = COMM_TYPE_H2D;
-        cmd.hdr.category = COMM_CATEGORY_DEBUG;
-        cmd.hdr.opcode = CMD_DBG_LOG_LEVEL;
-        for (i = 0; ((token = strsep(&str_buf, ",")) != NULL) &&
-                     (i < FW_LOG_SRC_MAX); i++) {
-                while (isspace(*token))
-                        ++token;
-                if (strict_strtol(token, HEXADECIMAL_RADIX, &val)) {
-                        LOG_ERROR(priv, DEBUGFS,
-                                  "failed to convert string to long %s\n",
-                                  token);
-                        ret = -EINVAL;
-                        goto exit;
-                }
-                mask  = val & 0xFF; /* LSB */
-                src = (val & 0XFF00) >> 8; /* 2nd least significant byte. */
-                iwmct_log_set_fw_filter(src, mask);
-                cmd.u.logdefs[i].logsource = src;
-                cmd.u.logdefs[i].sevmask = mask;
-        }
-        cmd.hdr.length = cpu_to_le16(i * sizeof(cmd.u.logdefs[0]));
-        cmdlen = (i * sizeof(cmd.u.logdefs[0]) + sizeof(cmd.hdr));
-        ret = iwmct_send_hcmd(priv, (u8 *)&cmd, cmdlen);
-        if (ret) {
-                LOG_ERROR(priv, DEBUGFS,
-                          "Failed to send %d bytes of fwcmd, ret=%zd\n",
-                          cmdlen, ret);
-                goto exit;
-        } else
-                LOG_INFO(priv, DEBUGFS, "fwcmd sent (%d bytes)\n", cmdlen);
-        ret = count;
-exit:
-        kfree(str_buf);
-        return ret;
-}
diff --git a/drivers/misc/iwmc3200top/log.h b/drivers/misc/iwmc3200top/log.h
deleted file mode 100644
index 4434bb16cea7..000000000000
--- a/drivers/misc/iwmc3200top/log.h
+++ /dev/null
@@ -1,171 +0,0 @@
-/*
- * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
- * drivers/misc/iwmc3200top/log.h
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version
- * 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- *
- *
- * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
- *  -
- *
- */
-#ifndef __LOG_H__
-#define __LOG_H__
-/* log severity:
- * The log levels here match FW log levels
- * so values need to stay as is */
-#define LOG_SEV_CRITICAL                0
-#define LOG_SEV_ERROR                   1
-#define LOG_SEV_WARNING                 2
-#define LOG_SEV_INFO                    3
-#define LOG_SEV_INFOEX                  4
-/* Log levels not defined for FW */
-#define LOG_SEV_TRACE                   5
-#define LOG_SEV_DUMP                    6
-#define LOG_SEV_FW_FILTER_ALL           \
-        (BIT(LOG_SEV_CRITICAL)  |       \
-         BIT(LOG_SEV_ERROR)     |       \
-         BIT(LOG_SEV_WARNING)   |       \
-         BIT(LOG_SEV_INFO)      |       \
-         BIT(LOG_SEV_INFOEX))
-#define LOG_SEV_FILTER_ALL              \
-        (BIT(LOG_SEV_CRITICAL)  |       \
-         BIT(LOG_SEV_ERROR)     |       \
-         BIT(LOG_SEV_WARNING)   |       \
-         BIT(LOG_SEV_INFO)      |       \
-         BIT(LOG_SEV_INFOEX)    |       \
-         BIT(LOG_SEV_TRACE)     |       \
-         BIT(LOG_SEV_DUMP))
-/* log source */
-#define LOG_SRC_INIT                    0
-#define LOG_SRC_DEBUGFS                 1
-#define LOG_SRC_FW_DOWNLOAD             2
-#define LOG_SRC_FW_MSG                  3
-#define LOG_SRC_TST                     4
-#define LOG_SRC_IRQ                     5
-#define LOG_SRC_MAX                     6
-#define LOG_SRC_ALL                     0xFF
-/**
- * Default intitialization runtime log level
- */
-#ifndef LOG_SEV_FILTER_RUNTIME
-#define LOG_SEV_FILTER_RUNTIME                  \
-        (BIT(LOG_SEV_CRITICAL)  |               \
-         BIT(LOG_SEV_ERROR)     |               \
-         BIT(LOG_SEV_WARNING))
-#endif
-#ifndef FW_LOG_SEV_FILTER_RUNTIME
-#define FW_LOG_SEV_FILTER_RUNTIME       LOG_SEV_FILTER_ALL
-#endif
-#ifdef CONFIG_IWMC3200TOP_DEBUG
-/**
- * Log macros
- */
-#define priv2dev(priv) (&(priv->func)->dev)
-#define LOG_CRITICAL(priv, src, fmt, args...)                           \
-do {                                                                    \
-        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_CRITICAL))     \
-                dev_crit(priv2dev(priv), "%s %d: " fmt,                 \
-                        __func__, __LINE__, ##args);                    \
-} while (0)
-#define LOG_ERROR(priv, src, fmt, args...)                              \
-do {                                                                    \
-        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_ERROR))        \
-                dev_err(priv2dev(priv), "%s %d: " fmt,                  \
-                        __func__, __LINE__, ##args);                    \
-} while (0)
-#define LOG_WARNING(priv, src, fmt, args...)                            \
-do {                                                                    \
-        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_WARNING))      \
-                dev_warn(priv2dev(priv), "%s %d: " fmt,                 \
-                         __func__, __LINE__, ##args);                   \
-} while (0)
-#define LOG_INFO(priv, src, fmt, args...)                               \
-do {                                                                    \
-        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_INFO))         \
-                dev_info(priv2dev(priv), "%s %d: " fmt,                 \
-                         __func__, __LINE__, ##args);                   \
-} while (0)
-#define LOG_TRACE(priv, src, fmt, args...)                              \
-do {                                                                    \
-        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_TRACE))        \
-                dev_dbg(priv2dev(priv), "%s %d: " fmt,                  \
-                         __func__, __LINE__, ##args);                   \
-} while (0)
-#define LOG_HEXDUMP(src, ptr, len)                                      \
-do {                                                                    \
-        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_DUMP)) \
-                print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_NONE,        \
-                                16, 1, ptr, len, false);                \
-} while (0)
-void iwmct_log_top_message(struct iwmct_priv *priv, u8 *buf, int len);
-extern u8 iwmct_logdefs[];
-int iwmct_log_set_filter(u8 src, u8 logmask);
-int iwmct_log_set_fw_filter(u8 src, u8 logmask);
-ssize_t show_iwmct_log_level(struct device *d,
-                        struct device_attribute *attr, char *buf);
-ssize_t store_iwmct_log_level(struct device *d,
-                        struct device_attribute *attr,
-                        const char *buf, size_t count);
-ssize_t show_iwmct_log_level_fw(struct device *d,
-                        struct device_attribute *attr, char *buf);
-ssize_t store_iwmct_log_level_fw(struct device *d,
-                        struct device_attribute *attr,
-                        const char *buf, size_t count);
-#else
-#define LOG_CRITICAL(priv, src, fmt, args...)
-#define LOG_ERROR(priv, src, fmt, args...)
-#define LOG_WARNING(priv, src, fmt, args...)
-#define LOG_INFO(priv, src, fmt, args...)
-#define LOG_TRACE(priv, src, fmt, args...)
-#define LOG_HEXDUMP(src, ptr, len)
-static inline void iwmct_log_top_message(struct iwmct_priv *priv,
-                                         u8 *buf, int len) {}
-static inline int iwmct_log_set_filter(u8 src, u8 logmask) { return 0; }
-static inline int iwmct_log_set_fw_filter(u8 src, u8 logmask) { return 0; }
-#endif /* CONFIG_IWMC3200TOP_DEBUG */
-int log_get_filter_str(char *buf, int size);
-int log_get_fw_filter_str(char *buf, int size);
-#endif /* __LOG_H__ */
diff --git a/drivers/misc/iwmc3200top/main.c b/drivers/misc/iwmc3200top/main.c
deleted file mode 100644
index 701eb600b127..000000000000
--- a/drivers/misc/iwmc3200top/main.c
+++ /dev/null
@@ -1,662 +0,0 @@
-/*
- * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
- * drivers/misc/iwmc3200top/main.c
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version
- * 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- *
- *
- * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
- *  -
- *
- */
-#include <linux/module.h>
-#include <linux/slab.h>
-#include <linux/init.h>
-#include <linux/kernel.h>
-#include <linux/debugfs.h>
-#include <linux/mmc/sdio_ids.h>
-#include <linux/mmc/sdio_func.h>
-#include <linux/mmc/sdio.h>
-#include "iwmc3200top.h"
-#include "log.h"
-#include "fw-msg.h"
-#include "debugfs.h"
-#define DRIVER_DESCRIPTION "Intel(R) IWMC 3200 Top Driver"
-#define DRIVER_COPYRIGHT "Copyright (c) 2008 Intel Corporation."
-#define DRIVER_VERSION  "0.1.62"
-MODULE_DESCRIPTION(DRIVER_DESCRIPTION);
-MODULE_VERSION(DRIVER_VERSION);
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR(DRIVER_COPYRIGHT);
-MODULE_FIRMWARE(FW_NAME(FW_API_VER));
-static inline int __iwmct_tx(struct iwmct_priv *priv, void *src, int count)
-{
-        return sdio_memcpy_toio(priv->func, IWMC_SDIO_DATA_ADDR, src, count);
-}
-int iwmct_tx(struct iwmct_priv *priv, void *src, int count)
-{
-        int ret;
-        sdio_claim_host(priv->func);
-        ret =  __iwmct_tx(priv, src, count);
-        sdio_release_host(priv->func);
-        return ret;
-}
-/*
- * This workers main task is to wait for OP_OPR_ALIVE
- * from TOP FW until ALIVE_MSG_TIMOUT timeout is elapsed.
- * When OP_OPR_ALIVE received it will issue
- * a call to "bus_rescan_devices".
- */
-static void iwmct_rescan_worker(struct work_struct *ws)
-{
-        struct iwmct_priv *priv;
-        int ret;
-        priv = container_of(ws, struct iwmct_priv, bus_rescan_worker);
-        LOG_INFO(priv, FW_MSG, "Calling bus_rescan\n");
-        ret = bus_rescan_devices(priv->func->dev.bus);
-        if (ret < 0)
-                LOG_INFO(priv, INIT, "bus_rescan_devices FAILED!!!\n");
-}
-static void op_top_message(struct iwmct_priv *priv, struct top_msg *msg)
-{
-        switch (msg->hdr.opcode) {
-        case OP_OPR_ALIVE:
-                LOG_INFO(priv, FW_MSG, "Got ALIVE from device, wake rescan\n");
-                schedule_work(&priv->bus_rescan_worker);
-                break;
-        default:
-                LOG_INFO(priv, FW_MSG, "Received msg opcode 0x%X\n",
-                        msg->hdr.opcode);
-                break;
-        }
-}
-static void handle_top_message(struct iwmct_priv *priv, u8 *buf, int len)
-{
-        struct top_msg *msg;
-        msg = (struct top_msg *)buf;
-        if (msg->hdr.type != COMM_TYPE_D2H) {
-                LOG_ERROR(priv, FW_MSG,
-                        "Message from TOP with invalid message type 0x%X\n",
-                        msg->hdr.type);
-                return;
-        }
-        if (len < sizeof(msg->hdr)) {
-                LOG_ERROR(priv, FW_MSG,
-                        "Message from TOP is too short for message header "
-                        "received %d bytes, expected at least %zd bytes\n",
-                        len, sizeof(msg->hdr));
-                return;
-        }
-        if (len < le16_to_cpu(msg->hdr.length) + sizeof(msg->hdr)) {
-                LOG_ERROR(priv, FW_MSG,
-                        "Message length (%d bytes) is shorter than "
-                        "in header (%d bytes)\n",
-                        len, le16_to_cpu(msg->hdr.length));
-                return;
-        }
-        switch (msg->hdr.category) {
-        case COMM_CATEGORY_OPERATIONAL:
-                op_top_message(priv, (struct top_msg *)buf);
-                break;
-        case COMM_CATEGORY_DEBUG:
-        case COMM_CATEGORY_TESTABILITY:
-        case COMM_CATEGORY_DIAGNOSTICS:
-                iwmct_log_top_message(priv, buf, len);
-                break;
-        default:
-                LOG_ERROR(priv, FW_MSG,
-                        "Message from TOP with unknown category 0x%X\n",
-                        msg->hdr.category);
-                break;
-        }
-}
-int iwmct_send_hcmd(struct iwmct_priv *priv, u8 *cmd, u16 len)
-{
-        int ret;
-        u8 *buf;
-        LOG_TRACE(priv, FW_MSG, "Sending hcmd:\n");
-        /* add padding to 256 for IWMC */
-        ((struct top_msg *)cmd)->hdr.flags |= CMD_FLAG_PADDING_256;
-        LOG_HEXDUMP(FW_MSG, cmd, len);
-        if (len > FW_HCMD_BLOCK_SIZE) {
-                LOG_ERROR(priv, FW_MSG, "size %d exceeded hcmd max size %d\n",
-                          len, FW_HCMD_BLOCK_SIZE);
-                return -1;
-        }
-        buf = kzalloc(FW_HCMD_BLOCK_SIZE, GFP_KERNEL);
-        if (!buf) {
-                LOG_ERROR(priv, FW_MSG, "kzalloc error, buf size %d\n",
-                          FW_HCMD_BLOCK_SIZE);
-                return -1;
-        }
-        memcpy(buf, cmd, len);
-        ret = iwmct_tx(priv, buf, FW_HCMD_BLOCK_SIZE);
-        kfree(buf);
-        return ret;
-}
-static void iwmct_irq_read_worker(struct work_struct *ws)
-{
-        struct iwmct_priv *priv;
-        struct iwmct_work_struct *read_req;
-        __le32 *buf = NULL;
-        int ret;
-        int iosize;
-        u32 barker;
-        bool is_barker;
-        priv = container_of(ws, struct iwmct_priv, isr_worker);
-        LOG_TRACE(priv, IRQ, "enter iwmct_irq_read_worker %p\n", ws);
-        /* --------------------- Handshake with device -------------------- */
-        sdio_claim_host(priv->func);
-        /* all list manipulations have to be protected by
-         * sdio_claim_host/sdio_release_host */
-        if (list_empty(&priv->read_req_list)) {
-                LOG_ERROR(priv, IRQ, "read_req_list empty in read worker\n");
-                goto exit_release;
-        }
-        read_req = list_entry(priv->read_req_list.next,
-                              struct iwmct_work_struct, list);
-        list_del(&read_req->list);
-        iosize = read_req->iosize;
-        kfree(read_req);
-        buf = kzalloc(iosize, GFP_KERNEL);
-        if (!buf) {
-                LOG_ERROR(priv, IRQ, "kzalloc error, buf size %d\n", iosize);
-                goto exit_release;
-        }
-        LOG_INFO(priv, IRQ, "iosize=%d, buf=%p, func=%d\n",
-                                iosize, buf, priv->func->num);
-        /* read from device */
-        ret = sdio_memcpy_fromio(priv->func, buf, IWMC_SDIO_DATA_ADDR, iosize);
-        if (ret) {
-                LOG_ERROR(priv, IRQ, "error %d reading buffer\n", ret);
-                goto exit_release;
-        }
-        LOG_HEXDUMP(IRQ, (u8 *)buf, iosize);
-        barker = le32_to_cpu(buf[0]);
-        /* Verify whether it's a barker and if not - treat as regular Rx */
-        if (barker == IWMC_BARKER_ACK ||
-            (barker & BARKER_DNLOAD_BARKER_MSK) == IWMC_BARKER_REBOOT) {
-                /* Valid Barker is equal on first 4 dwords */
-                is_barker = (buf[1] == buf[0]) &&
-                            (buf[2] == buf[0]) &&
-                            (buf[3] == buf[0]);
-                if (!is_barker) {
-                        LOG_WARNING(priv, IRQ,
-                                "Potentially inconsistent barker "
-                                "%08X_%08X_%08X_%08X\n",
-                                le32_to_cpu(buf[0]), le32_to_cpu(buf[1]),
-                                le32_to_cpu(buf[2]), le32_to_cpu(buf[3]));
-                }
-        } else {
-                is_barker = false;
-        }
-        /* Handle Top CommHub message */
-        if (!is_barker) {
-                sdio_release_host(priv->func);
-                handle_top_message(priv, (u8 *)buf, iosize);
-                goto exit;
-        } else if (barker == IWMC_BARKER_ACK) { /* Handle barkers */
-                if (atomic_read(&priv->dev_sync) == 0) {
-                        LOG_ERROR(priv, IRQ,
-                                  "ACK barker arrived out-of-sync\n");
-                        goto exit_release;
-                }
-                /* Continuing to FW download (after Sync is completed)*/
-                atomic_set(&priv->dev_sync, 0);
-                LOG_INFO(priv, IRQ, "ACK barker arrived "
-                                "- starting FW download\n");
-        } else { /* REBOOT barker */
-                LOG_INFO(priv, IRQ, "Received reboot barker: %x\n", barker);
-                priv->barker = barker;
-                if (barker & BARKER_DNLOAD_SYNC_MSK) {
-                        /* Send the same barker back */
-                        ret = __iwmct_tx(priv, buf, iosize);
-                        if (ret) {
-                                LOG_ERROR(priv, IRQ,
-                                         "error %d echoing barker\n", ret);
-                                goto exit_release;
-                        }
-                        LOG_INFO(priv, IRQ, "Echoing barker to device\n");
-                        atomic_set(&priv->dev_sync, 1);
-                        goto exit_release;
-                }
-                /* Continuing to FW download (without Sync) */
-                LOG_INFO(priv, IRQ, "No sync requested "
-                                    "- starting FW download\n");
-        }
-        sdio_release_host(priv->func);
-        if (priv->dbg.fw_download)
-                iwmct_fw_load(priv);
-        else
-                LOG_ERROR(priv, IRQ, "FW download not allowed\n");
-        goto exit;
-exit_release:
-        sdio_release_host(priv->func);
-exit:
-        kfree(buf);
-        LOG_TRACE(priv, IRQ, "exit iwmct_irq_read_worker\n");
-}
-static void iwmct_irq(struct sdio_func *func)
-{
-        struct iwmct_priv *priv;
-        int val, ret;
-        int iosize;
-        int addr = IWMC_SDIO_INTR_GET_SIZE_ADDR;
-        struct iwmct_work_struct *read_req;
-        priv = sdio_get_drvdata(func);
-        LOG_TRACE(priv, IRQ, "enter iwmct_irq\n");
-        /* read the function's status register */
-        val = sdio_readb(func, IWMC_SDIO_INTR_STATUS_ADDR, &ret);
-        LOG_TRACE(priv, IRQ, "iir value = %d, ret=%d\n", val, ret);
-        if (!val) {
-                LOG_ERROR(priv, IRQ, "iir = 0, exiting ISR\n");
-                goto exit_clear_intr;
-        }
-        /*
-         * read 2 bytes of the transaction size
-         * IMPORTANT: sdio transaction size has to be read before clearing
-         * sdio interrupt!!!
-         */
-        val = sdio_readb(priv->func, addr++, &ret);
-        iosize = val;
-        val = sdio_readb(priv->func, addr++, &ret);
-        iosize += val << 8;
-        LOG_INFO(priv, IRQ, "READ size %d\n", iosize);
-        if (iosize == 0) {
-                LOG_ERROR(priv, IRQ, "READ size %d, exiting ISR\n", iosize);
-                goto exit_clear_intr;
-        }
-        /* allocate a work structure to pass iosize to the worker */
-        read_req = kzalloc(sizeof(struct iwmct_work_struct), GFP_KERNEL);
-        if (!read_req) {
-                LOG_ERROR(priv, IRQ, "failed to allocate read_req, exit ISR\n");
-                goto exit_clear_intr;
-        }
-        INIT_LIST_HEAD(&read_req->list);
-        read_req->iosize = iosize;
-        list_add_tail(&priv->read_req_list, &read_req->list);
-        /* clear the function's interrupt request bit (write 1 to clear) */
-        sdio_writeb(func, 1, IWMC_SDIO_INTR_CLEAR_ADDR, &ret);
-        schedule_work(&priv->isr_worker);
-        LOG_TRACE(priv, IRQ, "exit iwmct_irq\n");
-        return;
-exit_clear_intr:
-        /* clear the function's interrupt request bit (write 1 to clear) */
-        sdio_writeb(func, 1, IWMC_SDIO_INTR_CLEAR_ADDR, &ret);
-}
-static int blocks;
-module_param(blocks, int, 0604);
-MODULE_PARM_DESC(blocks, "max_blocks_to_send");
-static bool dump;
-module_param(dump, bool, 0604);
-MODULE_PARM_DESC(dump, "dump_hex_content");
-static bool jump = 1;
-module_param(jump, bool, 0604);
-static bool direct = 1;
-module_param(direct, bool, 0604);
-static bool checksum = 1;
-module_param(checksum, bool, 0604);
-static bool fw_download = 1;
-module_param(fw_download, bool, 0604);
-static int block_size = IWMC_SDIO_BLK_SIZE;
-module_param(block_size, int, 0404);
-static int download_trans_blks = IWMC_DEFAULT_TR_BLK;
-module_param(download_trans_blks, int, 0604);
-static bool rubbish_barker;
-module_param(rubbish_barker, bool, 0604);
-#ifdef CONFIG_IWMC3200TOP_DEBUG
-static int log_level[LOG_SRC_MAX];
-static unsigned int log_level_argc;
-module_param_array(log_level, int, &log_level_argc, 0604);
-MODULE_PARM_DESC(log_level, "log_level");
-static int log_level_fw[FW_LOG_SRC_MAX];
-static unsigned int log_level_fw_argc;
-module_param_array(log_level_fw, int, &log_level_fw_argc, 0604);
-MODULE_PARM_DESC(log_level_fw, "log_level_fw");
-#endif
-void iwmct_dbg_init_params(struct iwmct_priv *priv)
-{
-#ifdef CONFIG_IWMC3200TOP_DEBUG
-        int i;
-        for (i = 0; i < log_level_argc; i++) {
-                dev_notice(&priv->func->dev, "log_level[%d]=0x%X\n",
-                                                i, log_level[i]);
-                iwmct_log_set_filter((log_level[i] >> 8) & 0xFF,
-                               log_level[i] & 0xFF);
-        }
-        for (i = 0; i < log_level_fw_argc; i++) {
-                dev_notice(&priv->func->dev, "log_level_fw[%d]=0x%X\n",
-                                                i, log_level_fw[i]);
-                iwmct_log_set_fw_filter((log_level_fw[i] >> 8) & 0xFF,
-                                  log_level_fw[i] & 0xFF);
-        }
-#endif
-        priv->dbg.blocks = blocks;
-        LOG_INFO(priv, INIT, "blocks=%d\n", blocks);
-        priv->dbg.dump = (bool)dump;
-        LOG_INFO(priv, INIT, "dump=%d\n", dump);
-        priv->dbg.jump = (bool)jump;
-        LOG_INFO(priv, INIT, "jump=%d\n", jump);
-        priv->dbg.direct = (bool)direct;
-        LOG_INFO(priv, INIT, "direct=%d\n", direct);
-        priv->dbg.checksum = (bool)checksum;
-        LOG_INFO(priv, INIT, "checksum=%d\n", checksum);
-        priv->dbg.fw_download = (bool)fw_download;
-        LOG_INFO(priv, INIT, "fw_download=%d\n", fw_download);
-        priv->dbg.block_size = block_size;
-        LOG_INFO(priv, INIT, "block_size=%d\n", block_size);
-        priv->dbg.download_trans_blks = download_trans_blks;
-        LOG_INFO(priv, INIT, "download_trans_blks=%d\n", download_trans_blks);
-}
-/*****************************************************************************
- *
- * sysfs attributes
- *
- *****************************************************************************/
-static ssize_t show_iwmct_fw_version(struct device *d,
-                                  struct device_attribute *attr, char *buf)
-{
-        struct iwmct_priv *priv = dev_get_drvdata(d);
-        return sprintf(buf, "%s\n", priv->dbg.label_fw);
-}
-static DEVICE_ATTR(cc_label_fw, S_IRUGO, show_iwmct_fw_version, NULL);
-#ifdef CONFIG_IWMC3200TOP_DEBUG
-static DEVICE_ATTR(log_level, S_IWUSR | S_IRUGO,
-                   show_iwmct_log_level, store_iwmct_log_level);
-static DEVICE_ATTR(log_level_fw, S_IWUSR | S_IRUGO,
-                   show_iwmct_log_level_fw, store_iwmct_log_level_fw);
-#endif
-static struct attribute *iwmct_sysfs_entries[] = {
-        &dev_attr_cc_label_fw.attr,
-#ifdef CONFIG_IWMC3200TOP_DEBUG
-        &dev_attr_log_level.attr,
-        &dev_attr_log_level_fw.attr,
-#endif
-        NULL
-};
-static struct attribute_group iwmct_attribute_group = {
-        .name = NULL,           /* put in device directory */
-        .attrs = iwmct_sysfs_entries,
-};
-static int iwmct_probe(struct sdio_func *func,
-                           const struct sdio_device_id *id)
-{
-        struct iwmct_priv *priv;
-        int ret;
-        int val = 1;
-        int addr = IWMC_SDIO_INTR_ENABLE_ADDR;
-        dev_dbg(&func->dev, "enter iwmct_probe\n");
-        dev_dbg(&func->dev, "IRQ polling period id %u msecs, HZ is %d\n",
-                jiffies_to_msecs(2147483647), HZ);
-        priv = kzalloc(sizeof(struct iwmct_priv), GFP_KERNEL);
-        if (!priv) {
-                dev_err(&func->dev, "kzalloc error\n");
-                return -ENOMEM;
-        }
-        priv->func = func;
-        sdio_set_drvdata(func, priv);
-        INIT_WORK(&priv->bus_rescan_worker, iwmct_rescan_worker);
-        INIT_WORK(&priv->isr_worker, iwmct_irq_read_worker);
-        init_waitqueue_head(&priv->wait_q);
-        sdio_claim_host(func);
-        /* FIXME: Remove after it is fixed in the Boot ROM upgrade */
-        func->enable_timeout = 10;
-        /* In our HW, setting the block size also wakes up the boot rom. */
-        ret = sdio_set_block_size(func, priv->dbg.block_size);
-        if (ret) {
-                LOG_ERROR(priv, INIT,
-                        "sdio_set_block_size() failure: %d\n", ret);
-                goto error_sdio_enable;
-        }
-        ret = sdio_enable_func(func);
-        if (ret) {
-                LOG_ERROR(priv, INIT, "sdio_enable_func() failure: %d\n", ret);
-                goto error_sdio_enable;
-        }
-        /* init reset and dev_sync states */
-        atomic_set(&priv->reset, 0);
-        atomic_set(&priv->dev_sync, 0);
-        /* init read req queue */
-        INIT_LIST_HEAD(&priv->read_req_list);
-        /* process configurable parameters */
-        iwmct_dbg_init_params(priv);
-        ret = sysfs_create_group(&func->dev.kobj, &iwmct_attribute_group);
-        if (ret) {
-                LOG_ERROR(priv, INIT, "Failed to register attributes and "
-                         "initialize module_params\n");
-                goto error_dev_attrs;
-        }
-        iwmct_dbgfs_register(priv, DRV_NAME);
-        if (!priv->dbg.direct && priv->dbg.download_trans_blks > 8) {
-                LOG_INFO(priv, INIT,
-                         "Reducing transaction to 8 blocks = 2K (from %d)\n",
-                         priv->dbg.download_trans_blks);
-                priv->dbg.download_trans_blks = 8;
-        }
-        priv->trans_len = priv->dbg.download_trans_blks * priv->dbg.block_size;
-        LOG_INFO(priv, INIT, "Transaction length = %d\n", priv->trans_len);
-        ret = sdio_claim_irq(func, iwmct_irq);
-        if (ret) {
-                LOG_ERROR(priv, INIT, "sdio_claim_irq() failure: %d\n", ret);
-                goto error_claim_irq;
-        }
-        /* Enable function's interrupt */
-        sdio_writeb(priv->func, val, addr, &ret);
-        if (ret) {
-                LOG_ERROR(priv, INIT, "Failure writing to "
-                          "Interrupt Enable Register (%d): %d\n", addr, ret);
-                goto error_enable_int;
-        }
-        sdio_release_host(func);
-        LOG_INFO(priv, INIT, "exit iwmct_probe\n");
-        return ret;
-error_enable_int:
-        sdio_release_irq(func);
-error_claim_irq:
-        sdio_disable_func(func);
-error_dev_attrs:
-        iwmct_dbgfs_unregister(priv->dbgfs);
-        sysfs_remove_group(&func->dev.kobj, &iwmct_attribute_group);
-error_sdio_enable:
-        sdio_release_host(func);
-        return ret;
-}
-static void iwmct_remove(struct sdio_func *func)
-{
-        struct iwmct_work_struct *read_req;
-        struct iwmct_priv *priv = sdio_get_drvdata(func);
-        LOG_INFO(priv, INIT, "enter\n");
-        sdio_claim_host(func);
-        sdio_release_irq(func);
-        sdio_release_host(func);
-        /* Make sure works are finished */
-        flush_work_sync(&priv->bus_rescan_worker);
-        flush_work_sync(&priv->isr_worker);
-        sdio_claim_host(func);
-        sdio_disable_func(func);
-        sysfs_remove_group(&func->dev.kobj, &iwmct_attribute_group);
-        iwmct_dbgfs_unregister(priv->dbgfs);
-        sdio_release_host(func);
-        /* free read requests */
-        while (!list_empty(&priv->read_req_list)) {
-                read_req = list_entry(priv->read_req_list.next,
-                        struct iwmct_work_struct, list);
-                list_del(&read_req->list);
-                kfree(read_req);
-        }
-        kfree(priv);
-}
-static const struct sdio_device_id iwmct_ids[] = {
-        /* Intel Wireless MultiCom 3200 Top Driver */
-        { SDIO_DEVICE(SDIO_VENDOR_ID_INTEL, 0x1404)},
-        { },    /* Terminating entry */
-};
-MODULE_DEVICE_TABLE(sdio, iwmct_ids);
-static struct sdio_driver iwmct_driver = {
-        .probe          = iwmct_probe,
-        .remove         = iwmct_remove,
-        .name           = DRV_NAME,
-        .id_table       = iwmct_ids,
-};
-static int __init iwmct_init(void)
-{
-        int rc;
-        /* Default log filter settings */
-        iwmct_log_set_filter(LOG_SRC_ALL, LOG_SEV_FILTER_RUNTIME);
-        iwmct_log_set_filter(LOG_SRC_FW_MSG, LOG_SEV_FW_FILTER_ALL);
-        iwmct_log_set_fw_filter(LOG_SRC_ALL, FW_LOG_SEV_FILTER_RUNTIME);
-        rc = sdio_register_driver(&iwmct_driver);
-        return rc;
-}
-static void __exit iwmct_exit(void)
-{
-        sdio_unregister_driver(&iwmct_driver);
-}
-module_init(iwmct_init);
-module_exit(iwmct_exit);
diff --git a/drivers/net/wimax/i2400m/Kconfig b/drivers/net/wimax/i2400m/Kconfig
index 672de18a776c..71453db14258 100644
--- a/drivers/net/wimax/i2400m/Kconfig
+++ b/drivers/net/wimax/i2400m/Kconfig
@@ -7,9 +7,6 @@ config WIMAX_I2400M
 comment "Enable USB support to see WiMAX USB drivers"
        depends on USB = n
-comment "Enable MMC support to see WiMAX SDIO drivers"
-        depends on MMC = n
 config WIMAX_I2400M_USB
        tristate "Intel Wireless WiMAX Connection 2400 over USB (including 5x50)"
        depends on WIMAX && USB
@@ -21,25 +18,6 @@ config WIMAX_I2400M_USB
          If unsure, it is safe to select M (module).
-config WIMAX_I2400M_SDIO
-        tristate "Intel Wireless WiMAX Connection 2400 over SDIO"
-        depends on WIMAX && MMC
-        select WIMAX_I2400M
-        help
-          Select if you have a device based on the Intel WiMAX
-          Connection 2400 over SDIO.
-          If unsure, it is safe to select M (module).
-config WIMAX_IWMC3200_SDIO
-        bool "Intel Wireless Multicom WiMAX Connection 3200 over SDIO (EXPERIMENTAL)"
-        depends on WIMAX_I2400M_SDIO
-        depends on EXPERIMENTAL
-        select IWMC3200TOP
-        help
-          Select if you have a device based on the Intel Multicom WiMAX
-          Connection 3200 over SDIO.
 config WIMAX_I2400M_DEBUG_LEVEL
        int "WiMAX i2400m debug level"
        depends on WIMAX_I2400M
diff --git a/drivers/net/wimax/i2400m/Makefile b/drivers/net/wimax/i2400m/Makefile
index 5d9e018d31af..f6d19c348082 100644
--- a/drivers/net/wimax/i2400m/Makefile
+++ b/drivers/net/wimax/i2400m/Makefile
@@ -1,7 +1,6 @@
 obj-$(CONFIG_WIMAX_I2400M) += i2400m.o
 obj-$(CONFIG_WIMAX_I2400M_USB) += i2400m-usb.o
-obj-$(CONFIG_WIMAX_I2400M_SDIO) += i2400m-sdio.o
 i2400m-y :=             \
        control.o       \
@@ -21,10 +20,3 @@ i2400m-usb-y :=			\
        usb-tx.o                \
        usb-rx.o                \
        usb.o
-i2400m-sdio-y :=                \
-        sdio.o                  \
-        sdio-tx.o               \
-        sdio-fw.o               \
-        sdio-rx.o
diff --git a/drivers/net/wimax/i2400m/driver.c b/drivers/net/wimax/i2400m/driver.c
index 47cae7150bc1..850b8bc38bee 100644
--- a/drivers/net/wimax/i2400m/driver.c
+++ b/drivers/net/wimax/i2400m/driver.c
@@ -754,8 +754,7 @@ EXPORT_SYMBOL_GPL(i2400m_error_recovery);
 /*
 * Alloc the command and ack buffers for boot mode
 *
- * Get the buffers needed to deal with boot mode messages.  These
+ * Get the buffers needed to deal with boot mode messages.
- * buffers need to be allocated before the sdio receive irq is setup.
 */
 static
 int i2400m_bm_buf_alloc(struct i2400m *i2400m)
diff --git a/drivers/net/wimax/i2400m/fw.c b/drivers/net/wimax/i2400m/fw.c
index d09e44970e63..283237f6f074 100644
--- a/drivers/net/wimax/i2400m/fw.c
+++ b/drivers/net/wimax/i2400m/fw.c
@@ -51,8 +51,7 @@
 * firmware. Normal hardware takes only signed firmware.
 *
 * On boot mode, in USB, we write to the device using the bulk out
- * endpoint and read from it in the notification endpoint. In SDIO we
+ * endpoint and read from it in the notification endpoint.
- * talk to it via the write address and read from the read address.
 *
 * Upon entrance to boot mode, the device sends (preceded with a few
 * zero length packets (ZLPs) on the notification endpoint in USB) a
diff --git a/drivers/net/wimax/i2400m/i2400m-sdio.h b/drivers/net/wimax/i2400m/i2400m-sdio.h
deleted file mode 100644
index 1d63ffdedfde..000000000000
--- a/drivers/net/wimax/i2400m/i2400m-sdio.h
+++ /dev/null
@@ -1,157 +0,0 @@
-/*
- * Intel Wireless WiMAX Connection 2400m
- * SDIO-specific i2400m driver definitions
- *
- *
- * Copyright (C) 2007-2008 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <linux-wimax@intel.com>
- * Brian Bian <brian.bian@intel.com>
- * Dirk Brandewie <dirk.j.brandewie@intel.com>
- * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
- * Yanir Lubetkin <yanirx.lubetkin@intel.com>
- *  - Initial implementation
- *
- *
- * This driver implements the bus-specific part of the i2400m for
- * SDIO. Check i2400m.h for a generic driver description.
- *
- * ARCHITECTURE
- *
- * This driver sits under the bus-generic i2400m driver, providing the
- * connection to the device.
- *
- * When probed, all the function pointers are setup and then the
- * bus-generic code called. The generic driver will then use the
- * provided pointers for uploading firmware (i2400ms_bus_bm*() in
- * sdio-fw.c) and then setting up the device (i2400ms_dev_*() in
- * sdio.c).
- *
- * Once firmware is uploaded, TX functions (sdio-tx.c) are called when
- * data is ready for transmission in the TX fifo; then the SDIO IRQ is
- * fired and data is available (sdio-rx.c), it is sent to the generic
- * driver for processing with i2400m_rx.
- */
-#ifndef __I2400M_SDIO_H__
-#define __I2400M_SDIO_H__
-#include "i2400m.h"
-/* Host-Device interface for SDIO */
-enum {
-        I2400M_SDIO_BOOT_RETRIES = 3,
-        I2400MS_BLK_SIZE = 256,
-        I2400MS_PL_SIZE_MAX = 0x3E00,
-        I2400MS_DATA_ADDR = 0x0,
-        I2400MS_INTR_STATUS_ADDR = 0x13,
-        I2400MS_INTR_CLEAR_ADDR = 0x13,
-        I2400MS_INTR_ENABLE_ADDR = 0x14,
-        I2400MS_INTR_GET_SIZE_ADDR = 0x2C,
-        /* The number of ticks to wait for the device to signal that
-         * it is ready */
-        I2400MS_INIT_SLEEP_INTERVAL = 100,
-        /* How long to wait for the device to settle after reset */
-        I2400MS_SETTLE_TIME = 40,
-        /* The number of msec to wait for IOR after sending IOE */
-        IWMC3200_IOR_TIMEOUT = 10,
-};
-/**
- * struct i2400ms - descriptor for a SDIO connected i2400m
- *
- * @i2400m: bus-generic i2400m implementation; has to be first (see
- *     it's documentation in i2400m.h).
- *
- * @func: pointer to our SDIO function
- *
- * @tx_worker: workqueue struct used to TX data when the bus-generic
- *     code signals packets are pending for transmission to the device.
- *
- * @tx_workqueue: workqeueue used for data TX; we don't use the
- *     system's workqueue as that might cause deadlocks with code in
- *     the bus-generic driver. The read/write operation to the queue
- *     is protected with spinlock (tx_lock in struct i2400m) to avoid
- *     the queue being destroyed in the middle of a the queue read/write
- *     operation.
- *
- * @debugfs_dentry: dentry for the SDIO specific debugfs files
- *
- *     Note this value is set to NULL upon destruction; this is
- *     because some routinges use it to determine if we are inside the
- *     probe() path or some other path. When debugfs is disabled,
- *     creation sets the dentry to '(void*) -ENODEV', which is valid
- *     for the test.
- */
-struct i2400ms {
-        struct i2400m i2400m;           /* FIRST! See doc */
-        struct sdio_func *func;
-        struct work_struct tx_worker;
-        struct workqueue_struct *tx_workqueue;
-        char tx_wq_name[32];
-        struct dentry *debugfs_dentry;
-        wait_queue_head_t bm_wfa_wq;
-        int bm_wait_result;
-        size_t bm_ack_size;
-        /* Device is any of the iwmc3200 SKUs */
-        unsigned iwmc3200:1;
-};
-static inline
-void i2400ms_init(struct i2400ms *i2400ms)
-{
-        i2400m_init(&i2400ms->i2400m);
-}
-extern int i2400ms_rx_setup(struct i2400ms *);
-extern void i2400ms_rx_release(struct i2400ms *);
-extern int i2400ms_tx_setup(struct i2400ms *);
-extern void i2400ms_tx_release(struct i2400ms *);
-extern void i2400ms_bus_tx_kick(struct i2400m *);
-extern ssize_t i2400ms_bus_bm_cmd_send(struct i2400m *,
-                                       const struct i2400m_bootrom_header *,
-                                       size_t, int);
-extern ssize_t i2400ms_bus_bm_wait_for_ack(struct i2400m *,
-                                           struct i2400m_bootrom_header *,
-                                           size_t);
-extern void i2400ms_bus_bm_release(struct i2400m *);
-extern int i2400ms_bus_bm_setup(struct i2400m *);
-#endif /* #ifndef __I2400M_SDIO_H__ */
diff --git a/drivers/net/wimax/i2400m/i2400m.h b/drivers/net/wimax/i2400m/i2400m.h
index c806d4550212..79c6505b5c20 100644
--- a/drivers/net/wimax/i2400m/i2400m.h
+++ b/drivers/net/wimax/i2400m/i2400m.h
@@ -46,7 +46,7 @@
 *  - bus generic driver (this part)
 *
 * The bus specific driver sets up stuff specific to the bus the
- * device is connected to (USB, SDIO, PCI, tam-tam...non-authoritative
+ * device is connected to (USB, PCI, tam-tam...non-authoritative
 * nor binding list) which is basically the device-model management
 * (probe/disconnect, etc), moving data from device to kernel and
 * back, doing the power saving details and reseting the device.
@@ -238,14 +238,13 @@ struct i2400m_barker_db;
 * amount needed for loading firmware, where us dev_start/stop setup
 * the rest needed to do full data/control traffic.
 *
- * @bus_tx_block_size: [fill] SDIO imposes a 256 block size, USB 16,
+ * @bus_tx_block_size: [fill] USB imposes a 16 block size, but other
- *     so we have a tx_blk_size variable that the bus layer sets to
+ *     busses will differ.  So we have a tx_blk_size variable that the
- *     tell the engine how much of that we need.
+ *     bus layer sets to tell the engine how much of that we need.
 *
 * @bus_tx_room_min: [fill] Minimum room required while allocating
- *     TX queue's buffer space for message header. SDIO requires
+ *     TX queue's buffer space for message header. USB requires
- *     224 bytes and USB 16 bytes. Refer bus specific driver code
+ *     16 bytes. Refer to bus specific driver code for details.
- *     for details.
 *
 * @bus_pl_size_max: [fill] Maximum payload size.
 *
diff --git a/drivers/net/wimax/i2400m/sdio-debug-levels.h b/drivers/net/wimax/i2400m/sdio-debug-levels.h
deleted file mode 100644
index c51998741301..000000000000
--- a/drivers/net/wimax/i2400m/sdio-debug-levels.h
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * debug levels control file for the i2400m module's
- */
-#ifndef __debug_levels__h__
-#define __debug_levels__h__
-/* Maximum compile and run time debug level for all submodules */
-#define D_MODULENAME i2400m_sdio
-#define D_MASTER CONFIG_WIMAX_I2400M_DEBUG_LEVEL
-#include <linux/wimax/debug.h>
-/* List of all the enabled modules */
-enum d_module {
-        D_SUBMODULE_DECLARE(main),
-        D_SUBMODULE_DECLARE(tx),
-        D_SUBMODULE_DECLARE(rx),
-        D_SUBMODULE_DECLARE(fw)
-};
-#endif /* #ifndef __debug_levels__h__ */
diff --git a/drivers/net/wimax/i2400m/sdio-fw.c b/drivers/net/wimax/i2400m/sdio-fw.c
deleted file mode 100644
index 8e025418f5be..000000000000
--- a/drivers/net/wimax/i2400m/sdio-fw.c
+++ /dev/null
@@ -1,210 +0,0 @@
-/*
- * Intel Wireless WiMAX Connection 2400m
- * Firmware uploader's SDIO specifics
- *
- *
- * Copyright (C) 2007-2008 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <linux-wimax@intel.com>
- * Yanir Lubetkin <yanirx.lubetkin@intel.com>
- * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
- *  - Initial implementation
- *
- * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
- *  - Bus generic/specific split for USB
- *
- * Dirk Brandewie <dirk.j.brandewie@intel.com>
- *  - Initial implementation for SDIO
- *
- * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
- *  - SDIO rehash for changes in the bus-driver model
- *
- * Dirk Brandewie <dirk.j.brandewie@intel.com>
- *  - Make it IRQ based, not polling
- *
- * THE PROCEDURE
- *
- * See fw.c for the generic description of this procedure.
- *
- * This file implements only the SDIO specifics. It boils down to how
- * to send a command and waiting for an acknowledgement from the
- * device.
- *
- * All this code is sequential -- all i2400ms_bus_bm_*() functions are
- * executed in the same thread, except i2400ms_bm_irq() [on its own by
- * the SDIO driver]. This makes it possible to avoid locking.
- *
- * COMMAND EXECUTION
- *
- * The generic firmware upload code will call i2400m_bus_bm_cmd_send()
- * to send commands.
- *
- * The SDIO devices expects things in 256 byte blocks, so it will pad
- * it, compute the checksum (if needed) and pass it to SDIO.
- *
- * ACK RECEPTION
- *
- * This works in IRQ mode -- the fw loader says when to wait for data
- * and for that it calls i2400ms_bus_bm_wait_for_ack().
- *
- * This checks if there is any data available (RX size > 0); if not,
- * waits for the IRQ handler to notify about it. Once there is data,
- * it is read and passed to the caller. Doing it this way we don't
- * need much coordination/locking, and it makes it much more difficult
- * for an interrupt to be lost and the wait_for_ack() function getting
- * stuck even when data is pending.
- */
-#include <linux/mmc/sdio_func.h>
-#include "i2400m-sdio.h"
-#define D_SUBMODULE fw
-#include "sdio-debug-levels.h"
-/*
- * Send a boot-mode command to the SDIO function
- *
- * We use a bounce buffer (i2400m->bm_cmd_buf) because we need to
- * touch the header if the RAW flag is not set.
- *
- * @flags: pass thru from i2400m_bm_cmd()
- * @return: cmd_size if ok, < 0 errno code on error.
- *
- * Note the command is padded to the SDIO block size for the device.
- */
-ssize_t i2400ms_bus_bm_cmd_send(struct i2400m *i2400m,
-                                const struct i2400m_bootrom_header *_cmd,
-                                size_t cmd_size, int flags)
-{
-        ssize_t result;
-        struct device *dev = i2400m_dev(i2400m);
-        struct i2400ms *i2400ms = container_of(i2400m, struct i2400ms, i2400m);
-        int opcode = _cmd == NULL ? -1 : i2400m_brh_get_opcode(_cmd);
-        struct i2400m_bootrom_header *cmd;
-        /* SDIO restriction */
-        size_t cmd_size_a = ALIGN(cmd_size, I2400MS_BLK_SIZE);
-        d_fnstart(5, dev, "(i2400m %p cmd %p size %zu)\n",
-                  i2400m, _cmd, cmd_size);
-        result = -E2BIG;
-        if (cmd_size > I2400M_BM_CMD_BUF_SIZE)
-                goto error_too_big;
-        if (_cmd != i2400m->bm_cmd_buf)
-                memmove(i2400m->bm_cmd_buf, _cmd, cmd_size);
-        cmd = i2400m->bm_cmd_buf;
-        if (cmd_size_a > cmd_size)                      /* Zero pad space */
-                memset(i2400m->bm_cmd_buf + cmd_size, 0, cmd_size_a - cmd_size);
-        if ((flags & I2400M_BM_CMD_RAW) == 0) {
-                if (WARN_ON(i2400m_brh_get_response_required(cmd) == 0))
-                        dev_warn(dev, "SW BUG: response_required == 0\n");
-                i2400m_bm_cmd_prepare(cmd);
-        }
-        d_printf(4, dev, "BM cmd %d: %zu bytes (%zu padded)\n",
-                 opcode, cmd_size, cmd_size_a);
-        d_dump(5, dev, cmd, cmd_size);
-        sdio_claim_host(i2400ms->func);                 /* Send & check */
-        result = sdio_memcpy_toio(i2400ms->func, I2400MS_DATA_ADDR,
-                                  i2400m->bm_cmd_buf, cmd_size_a);
-        sdio_release_host(i2400ms->func);
-        if (result < 0) {
-                dev_err(dev, "BM cmd %d: cannot send: %ld\n",
-                        opcode, (long) result);
-                goto error_cmd_send;
-        }
-        result = cmd_size;
-error_cmd_send:
-error_too_big:
-        d_fnend(5, dev, "(i2400m %p cmd %p size %zu) = %d\n",
-                i2400m, _cmd, cmd_size, (int) result);
-        return result;
-}
-/*
- * Read an ack from the device's boot-mode
- *
- * @i2400m:
- * @_ack: pointer to where to store the read data
- * @ack_size: how many bytes we should read
- *
- * Returns: < 0 errno code on error; otherwise, amount of received bytes.
- *
- * The ACK for a BM command is always at least sizeof(*ack) bytes, so
- * check for that. We don't need to check for device reboots
- *
- */
-ssize_t i2400ms_bus_bm_wait_for_ack(struct i2400m *i2400m,
-                                    struct i2400m_bootrom_header *ack,
-                                    size_t ack_size)
-{
-        ssize_t result;
-        struct i2400ms *i2400ms = container_of(i2400m, struct i2400ms, i2400m);
-        struct sdio_func *func = i2400ms->func;
-        struct device *dev = &func->dev;
-        int size;
-        BUG_ON(sizeof(*ack) > ack_size);
-        d_fnstart(5, dev, "(i2400m %p ack %p size %zu)\n",
-                  i2400m, ack, ack_size);
-        result = wait_event_timeout(i2400ms->bm_wfa_wq,
-                                    i2400ms->bm_ack_size != -EINPROGRESS,
-                                    2 * HZ);
-        if (result == 0) {
-                result = -ETIMEDOUT;
-                dev_err(dev, "BM: error waiting for an ack\n");
-                goto error_timeout;
-        }
-        spin_lock(&i2400m->rx_lock);
-        result = i2400ms->bm_ack_size;
-        BUG_ON(result == -EINPROGRESS);
-        if (result < 0)        /* so we exit when rx_release() is called */
-                dev_err(dev, "BM: %s failed: %zd\n", __func__, result);
-        else {
-                size = min(ack_size, i2400ms->bm_ack_size);
-                memcpy(ack, i2400m->bm_ack_buf, size);
-        }
-        /*
-         * Remember always to clear the bm_ack_size to -EINPROGRESS
-         * after the RX data is processed
-         */
-        i2400ms->bm_ack_size = -EINPROGRESS;
-        spin_unlock(&i2400m->rx_lock);
-error_timeout:
-        d_fnend(5, dev, "(i2400m %p ack %p size %zu) = %zd\n",
-                i2400m, ack, ack_size, result);
-        return result;
-}
diff --git a/drivers/net/wimax/i2400m/sdio-rx.c b/drivers/net/wimax/i2400m/sdio-rx.c
deleted file mode 100644
index fb6396dd115f..000000000000
--- a/drivers/net/wimax/i2400m/sdio-rx.c
+++ /dev/null
@@ -1,301 +0,0 @@
-/*
- * Intel Wireless WiMAX Connection 2400m
- * SDIO RX handling
- *
- *
- * Copyright (C) 2007-2008 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <linux-wimax@intel.com>
- * Dirk Brandewie <dirk.j.brandewie@intel.com>
- *  - Initial implementation
- *
- *
- * This handles the RX path on SDIO.
- *
- * The SDIO bus driver calls the "irq" routine when data is available.
- * This is not a traditional interrupt routine since the SDIO bus
- * driver calls us from its irq thread context.  Because of this
- * sleeping in the SDIO RX IRQ routine is okay.
- *
- * From there on, we obtain the size of the data that is available,
- * allocate an skb, copy it and then pass it to the generic driver's
- * RX routine [i2400m_rx()].
- *
- * ROADMAP
- *
- * i2400ms_irq()
- *   i2400ms_rx()
- *     __i2400ms_rx_get_size()
- *     i2400m_is_boot_barker()
- *     i2400m_rx()
- *
- * i2400ms_rx_setup()
- *
- * i2400ms_rx_release()
- */
-#include <linux/workqueue.h>
-#include <linux/wait.h>
-#include <linux/skbuff.h>
-#include <linux/mmc/sdio.h>
-#include <linux/mmc/sdio_func.h>
-#include <linux/slab.h>
-#include "i2400m-sdio.h"
-#define D_SUBMODULE rx
-#include "sdio-debug-levels.h"
-static const __le32 i2400m_ACK_BARKER[4] = {
-        __constant_cpu_to_le32(I2400M_ACK_BARKER),
-        __constant_cpu_to_le32(I2400M_ACK_BARKER),
-        __constant_cpu_to_le32(I2400M_ACK_BARKER),
-        __constant_cpu_to_le32(I2400M_ACK_BARKER)
-};
-/*
- * Read and return the amount of bytes available for RX
- *
- * The RX size has to be read like this: byte reads of three
- * sequential locations; then glue'em together.
- *
- * sdio_readl() doesn't work.
- */
-static ssize_t __i2400ms_rx_get_size(struct i2400ms *i2400ms)
-{
-        int ret, cnt, val;
-        ssize_t rx_size;
-        unsigned xfer_size_addr;
-        struct sdio_func *func = i2400ms->func;
-        struct device *dev = &i2400ms->func->dev;
-        d_fnstart(7, dev, "(i2400ms %p)\n", i2400ms);
-        xfer_size_addr = I2400MS_INTR_GET_SIZE_ADDR;
-        rx_size = 0;
-        for (cnt = 0; cnt < 3; cnt++) {
-                val = sdio_readb(func, xfer_size_addr + cnt, &ret);
-                if (ret < 0) {
-                        dev_err(dev, "RX: Can't read byte %d of RX size from "
-                                "0x%08x: %d\n", cnt, xfer_size_addr + cnt, ret);
-                        rx_size = ret;
-                        goto error_read;
-                }
-                rx_size = rx_size << 8 | (val & 0xff);
-        }
-        d_printf(6, dev, "RX: rx_size is %ld\n", (long) rx_size);
-error_read:
-        d_fnend(7, dev, "(i2400ms %p) = %ld\n", i2400ms, (long) rx_size);
-        return rx_size;
-}
-/*
- * Read data from the device (when in normal)
- *
- * Allocate an SKB of the right size, read the data in and then
- * deliver it to the generic layer.
- *
- * We also check for a reboot barker. That means the device died and
- * we have to reboot it.
- */
-static
-void i2400ms_rx(struct i2400ms *i2400ms)
-{
-        int ret;
-        struct sdio_func *func = i2400ms->func;
-        struct device *dev = &func->dev;
-        struct i2400m *i2400m = &i2400ms->i2400m;
-        struct sk_buff *skb;
-        ssize_t rx_size;
-        d_fnstart(7, dev, "(i2400ms %p)\n", i2400ms);
-        rx_size = __i2400ms_rx_get_size(i2400ms);
-        if (rx_size < 0) {
-                ret = rx_size;
-                goto error_get_size;
-        }
-        /*
-         * Hardware quirk: make sure to clear the INTR status register
-         * AFTER getting the data transfer size.
-         */
-        sdio_writeb(func, 1, I2400MS_INTR_CLEAR_ADDR, &ret);
-        ret = -ENOMEM;
-        skb = alloc_skb(rx_size, GFP_ATOMIC);
-        if (NULL == skb) {
-                dev_err(dev, "RX: unable to alloc skb\n");
-                goto error_alloc_skb;
-        }
-        ret = sdio_memcpy_fromio(func, skb->data,
-                                 I2400MS_DATA_ADDR, rx_size);
-        if (ret < 0) {
-                dev_err(dev, "RX: SDIO data read failed: %d\n", ret);
-                goto error_memcpy_fromio;
-        }
-        rmb();  /* make sure we get boot_mode from dev_reset_handle */
-        if (unlikely(i2400m->boot_mode == 1)) {
-                spin_lock(&i2400m->rx_lock);
-                i2400ms->bm_ack_size = rx_size;
-                spin_unlock(&i2400m->rx_lock);
-                memcpy(i2400m->bm_ack_buf, skb->data, rx_size);
-                wake_up(&i2400ms->bm_wfa_wq);
-                d_printf(5, dev, "RX: SDIO boot mode message\n");
-                kfree_skb(skb);
-                goto out;
-        }
-        ret = -EIO;
-        if (unlikely(rx_size < sizeof(__le32))) {
-                dev_err(dev, "HW BUG? only %zu bytes received\n", rx_size);
-                goto error_bad_size;
-        }
-        if (likely(i2400m_is_d2h_barker(skb->data))) {
-                skb_put(skb, rx_size);
-                i2400m_rx(i2400m, skb);
-        } else if (unlikely(i2400m_is_boot_barker(i2400m,
-                                                  skb->data, rx_size))) {
-                ret = i2400m_dev_reset_handle(i2400m, "device rebooted");
-                dev_err(dev, "RX: SDIO reboot barker\n");
-                kfree_skb(skb);
-        } else {
-                i2400m_unknown_barker(i2400m, skb->data, rx_size);
-                kfree_skb(skb);
-        }
-out:
-        d_fnend(7, dev, "(i2400ms %p) = void\n", i2400ms);
-        return;
-error_memcpy_fromio:
-        kfree_skb(skb);
-error_alloc_skb:
-error_get_size:
-error_bad_size:
-        d_fnend(7, dev, "(i2400ms %p) = %d\n", i2400ms, ret);
-}
-/*
- * Process an interrupt from the SDIO card
- *
- * FIXME: need to process other events that are not just ready-to-read
- *
- * Checks there is data ready and then proceeds to read it.
- */
-static
-void i2400ms_irq(struct sdio_func *func)
-{
-        int ret;
-        struct i2400ms *i2400ms = sdio_get_drvdata(func);
-        struct device *dev = &func->dev;
-        int val;
-        d_fnstart(6, dev, "(i2400ms %p)\n", i2400ms);
-        val = sdio_readb(func, I2400MS_INTR_STATUS_ADDR, &ret);
-        if (ret < 0) {
-                dev_err(dev, "RX: Can't read interrupt status: %d\n", ret);
-                goto error_no_irq;
-        }
-        if (!val) {
-                dev_err(dev, "RX: BUG? got IRQ but no interrupt ready?\n");
-                goto error_no_irq;
-        }
-        i2400ms_rx(i2400ms);
-error_no_irq:
-        d_fnend(6, dev, "(i2400ms %p) = void\n", i2400ms);
-}
-/*
- * Setup SDIO RX
- *
- * Hooks up the IRQ handler and then enables IRQs.
- */
-int i2400ms_rx_setup(struct i2400ms *i2400ms)
-{
-        int result;
-        struct sdio_func *func = i2400ms->func;
-        struct device *dev = &func->dev;
-        struct i2400m *i2400m = &i2400ms->i2400m;
-        d_fnstart(5, dev, "(i2400ms %p)\n", i2400ms);
-        init_waitqueue_head(&i2400ms->bm_wfa_wq);
-        spin_lock(&i2400m->rx_lock);
-        i2400ms->bm_wait_result = -EINPROGRESS;
-        /*
-         * Before we are about to enable the RX interrupt, make sure
-         * bm_ack_size is cleared to -EINPROGRESS which indicates
-         * no RX interrupt happened yet or the previous interrupt
-         * has been handled, we are ready to take the new interrupt
-         */
-        i2400ms->bm_ack_size = -EINPROGRESS;
-        spin_unlock(&i2400m->rx_lock);
-        sdio_claim_host(func);
-        result = sdio_claim_irq(func, i2400ms_irq);
-        if (result < 0) {
-                dev_err(dev, "Cannot claim IRQ: %d\n", result);
-                goto error_irq_claim;
-        }
-        result = 0;
-        sdio_writeb(func, 1, I2400MS_INTR_ENABLE_ADDR, &result);
-        if (result < 0) {
-                sdio_release_irq(func);
-                dev_err(dev, "Failed to enable interrupts %d\n", result);
-        }
-error_irq_claim:
-        sdio_release_host(func);
-        d_fnend(5, dev, "(i2400ms %p) = %d\n", i2400ms, result);
-        return result;
-}
-/*
- * Tear down SDIO RX
- *
- * Disables IRQs in the device and removes the IRQ handler.
- */
-void i2400ms_rx_release(struct i2400ms *i2400ms)
-{
-        int result;
-        struct sdio_func *func = i2400ms->func;
-        struct device *dev = &func->dev;
-        struct i2400m *i2400m = &i2400ms->i2400m;
-        d_fnstart(5, dev, "(i2400ms %p)\n", i2400ms);
-        spin_lock(&i2400m->rx_lock);
-        i2400ms->bm_ack_size = -EINTR;
-        spin_unlock(&i2400m->rx_lock);
-        wake_up_all(&i2400ms->bm_wfa_wq);
-        sdio_claim_host(func);
-        sdio_writeb(func, 0, I2400MS_INTR_ENABLE_ADDR, &result);
-        sdio_release_irq(func);
-        sdio_release_host(func);
-        d_fnend(5, dev, "(i2400ms %p) = %d\n", i2400ms, result);
-}
diff --git a/drivers/net/wimax/i2400m/sdio-tx.c b/drivers/net/wimax/i2400m/sdio-tx.c
deleted file mode 100644
index b53cd1c80e3e..000000000000
--- a/drivers/net/wimax/i2400m/sdio-tx.c
+++ /dev/null
@@ -1,177 +0,0 @@
-/*
- * Intel Wireless WiMAX Connection 2400m
- * SDIO TX transaction backends
- *
- *
- * Copyright (C) 2007-2008 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <linux-wimax@intel.com>
- * Dirk Brandewie <dirk.j.brandewie@intel.com>
- *  - Initial implementation
- *
- *
- * Takes the TX messages in the i2400m's driver TX FIFO and sends them
- * to the device until there are no more.
- *
- * If we fail sending the message, we just drop it. There isn't much
- * we can do at this point. Most of the traffic is network, which has
- * recovery methods for dropped packets.
- *
- * The SDIO functions are not atomic, so we can't run from the context
- * where i2400m->bus_tx_kick() [i2400ms_bus_tx_kick()] is being called
- * (some times atomic). Thus, the actual TX work is deferred to a
- * workqueue.
- *
- * ROADMAP
- *
- * i2400ms_bus_tx_kick()
- *   i2400ms_tx_submit()     [through workqueue]
- *
- * i2400m_tx_setup()
- *
- * i2400m_tx_release()
- */
-#include <linux/mmc/sdio_func.h>
-#include "i2400m-sdio.h"
-#define D_SUBMODULE tx
-#include "sdio-debug-levels.h"
-/*
- * Pull TX transations from the TX FIFO and send them to the device
- * until there are no more.
- */
-static
-void i2400ms_tx_submit(struct work_struct *ws)
-{
-        int result;
-        struct i2400ms *i2400ms = container_of(ws, struct i2400ms, tx_worker);
-        struct i2400m *i2400m = &i2400ms->i2400m;
-        struct sdio_func *func = i2400ms->func;
-        struct device *dev = &func->dev;
-        struct i2400m_msg_hdr *tx_msg;
-        size_t tx_msg_size;
-        d_fnstart(4, dev, "(i2400ms %p, i2400m %p)\n", i2400ms, i2400ms);
-        while (NULL != (tx_msg = i2400m_tx_msg_get(i2400m, &tx_msg_size))) {
-                d_printf(2, dev, "TX: submitting %zu bytes\n", tx_msg_size);
-                d_dump(5, dev, tx_msg, tx_msg_size);
-                sdio_claim_host(func);
-                result = sdio_memcpy_toio(func, 0, tx_msg, tx_msg_size);
-                sdio_release_host(func);
-                i2400m_tx_msg_sent(i2400m);
-                if (result < 0) {
-                        dev_err(dev, "TX: cannot submit TX; tx_msg @%zu %zu B:"
-                                " %d\n", (void *) tx_msg - i2400m->tx_buf,
-                                tx_msg_size, result);
-                }
-                if (result == -ETIMEDOUT) {
-                        i2400m_error_recovery(i2400m);
-                        break;
-                }
-                d_printf(2, dev, "TX: %zub submitted\n", tx_msg_size);
-        }
-        d_fnend(4, dev, "(i2400ms %p) = void\n", i2400ms);
-}
-/*
- * The generic driver notifies us that there is data ready for TX
- *
- * Schedule a run of i2400ms_tx_submit() to handle it.
- */
-void i2400ms_bus_tx_kick(struct i2400m *i2400m)
-{
-        struct i2400ms *i2400ms = container_of(i2400m, struct i2400ms, i2400m);
-        struct device *dev = &i2400ms->func->dev;
-        unsigned long flags;
-        d_fnstart(3, dev, "(i2400m %p) = void\n", i2400m);
-        /* schedule tx work, this is because tx may block, therefore
-         * it has to run in a thread context.
-         */
-        spin_lock_irqsave(&i2400m->tx_lock, flags);
-        if (i2400ms->tx_workqueue != NULL)
-                queue_work(i2400ms->tx_workqueue, &i2400ms->tx_worker);
-        spin_unlock_irqrestore(&i2400m->tx_lock, flags);
-        d_fnend(3, dev, "(i2400m %p) = void\n", i2400m);
-}
-int i2400ms_tx_setup(struct i2400ms *i2400ms)
-{
-        int result;
-        struct device *dev = &i2400ms->func->dev;
-        struct i2400m *i2400m = &i2400ms->i2400m;
-        struct workqueue_struct *tx_workqueue;
-        unsigned long flags;
-        d_fnstart(5, dev, "(i2400ms %p)\n", i2400ms);
-        INIT_WORK(&i2400ms->tx_worker, i2400ms_tx_submit);
-        snprintf(i2400ms->tx_wq_name, sizeof(i2400ms->tx_wq_name),
-                 "%s-tx", i2400m->wimax_dev.name);
-        tx_workqueue =
-                create_singlethread_workqueue(i2400ms->tx_wq_name);
-        if (tx_workqueue == NULL) {
-                dev_err(dev, "TX: failed to create workqueue\n");
-                result = -ENOMEM;
-        } else
-                result = 0;
-        spin_lock_irqsave(&i2400m->tx_lock, flags);
-        i2400ms->tx_workqueue = tx_workqueue;
-        spin_unlock_irqrestore(&i2400m->tx_lock, flags);
-        d_fnend(5, dev, "(i2400ms %p) = %d\n", i2400ms, result);
-        return result;
-}
-void i2400ms_tx_release(struct i2400ms *i2400ms)
-{
-        struct i2400m *i2400m = &i2400ms->i2400m;
-        struct workqueue_struct *tx_workqueue;
-        unsigned long flags;
-        tx_workqueue = i2400ms->tx_workqueue;
-        spin_lock_irqsave(&i2400m->tx_lock, flags);
-        i2400ms->tx_workqueue = NULL;
-        spin_unlock_irqrestore(&i2400m->tx_lock, flags);
-        if (tx_workqueue)
-                destroy_workqueue(tx_workqueue);
-}
diff --git a/drivers/net/wimax/i2400m/sdio.c b/drivers/net/wimax/i2400m/sdio.c
deleted file mode 100644
index 21a9edd6e75d..000000000000
--- a/drivers/net/wimax/i2400m/sdio.c
+++ /dev/null
@@ -1,602 +0,0 @@
-/*
- * Intel Wireless WiMAX Connection 2400m
- * Linux driver model glue for the SDIO device, reset & fw upload
- *
- *
- * Copyright (C) 2007-2008 Intel Corporation <linux-wimax@intel.com>
- * Dirk Brandewie <dirk.j.brandewie@intel.com>
- * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
- * Yanir Lubetkin <yanirx.lubetkin@intel.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version
- * 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- *
- *
- * See i2400m-sdio.h for a general description of this driver.
- *
- * This file implements driver model glue, and hook ups for the
- * generic driver to implement the bus-specific functions (device
- * communication setup/tear down, firmware upload and resetting).
- *
- * ROADMAP
- *
- * i2400m_probe()
- *   alloc_netdev()
- *     i2400ms_netdev_setup()
- *       i2400ms_init()
- *       i2400m_netdev_setup()
- *   i2400ms_enable_function()
- *   i2400m_setup()
- *
- * i2400m_remove()
- *     i2400m_release()
- *     free_netdev(net_dev)
- *
- * i2400ms_bus_reset()            Called by i2400m_reset
- *   __i2400ms_reset()
- *     __i2400ms_send_barker()
- */
-#include <linux/slab.h>
-#include <linux/debugfs.h>
-#include <linux/mmc/sdio_ids.h>
-#include <linux/mmc/sdio.h>
-#include <linux/mmc/sdio_func.h>
-#include "i2400m-sdio.h"
-#include <linux/wimax/i2400m.h>
-#include <linux/module.h>
-#define D_SUBMODULE main
-#include "sdio-debug-levels.h"
-/* IOE WiMAX function timeout in seconds */
-static int ioe_timeout = 2;
-module_param(ioe_timeout, int, 0);
-static char i2400ms_debug_params[128];
-module_param_string(debug, i2400ms_debug_params, sizeof(i2400ms_debug_params),
-                    0644);
-MODULE_PARM_DESC(debug,
-                 "String of space-separated NAME:VALUE pairs, where NAMEs "
-                 "are the different debug submodules and VALUE are the "
-                 "initial debug value to set.");
-/* Our firmware file name list */
-static const char *i2400ms_bus_fw_names[] = {
-#define I2400MS_FW_FILE_NAME "i2400m-fw-sdio-1.3.sbcf"
-        I2400MS_FW_FILE_NAME,
-        NULL
-};
-static const struct i2400m_poke_table i2400ms_pokes[] = {
-        I2400M_FW_POKE(0x6BE260, 0x00000088),
-        I2400M_FW_POKE(0x080550, 0x00000005),
-        I2400M_FW_POKE(0xAE0000, 0x00000000),
-        I2400M_FW_POKE(0x000000, 0x00000000), /* MUST be 0 terminated or bad
-                                               * things will happen */
-};
-/*
- * Enable the SDIO function
- *
- * Tries to enable the SDIO function; might fail if it is still not
- * ready (in some hardware, the SDIO WiMAX function is only enabled
- * when we ask it to explicitly doing). Tries until a timeout is
- * reached.
- *
- * The @maxtries argument indicates how many times (at most) it should
- * be tried to enable the function. 0 means forever. This acts along
- * with the timeout (ie: it'll stop trying as soon as the maximum
- * number of tries is reached _or_ as soon as the timeout is reached).
- *
- * The reverse of this is...sdio_disable_function()
- *
- * Returns: 0 if the SDIO function was enabled, < 0 errno code on
- *     error (-ENODEV when it was unable to enable the function).
- */
-static
-int i2400ms_enable_function(struct i2400ms *i2400ms, unsigned maxtries)
-{
-        struct sdio_func *func = i2400ms->func;
-        u64 timeout;
-        int err;
-        struct device *dev = &func->dev;
-        unsigned tries = 0;
-        d_fnstart(3, dev, "(func %p)\n", func);
-        /* Setup timeout (FIXME: This needs to read the CIS table to
-         * get a real timeout) and then wait for the device to signal
-         * it is ready */
-        timeout = get_jiffies_64() + ioe_timeout * HZ;
-        err = -ENODEV;
-        while (err != 0 && time_before64(get_jiffies_64(), timeout)) {
-                sdio_claim_host(func);
-                /*
-                 * There is a sillicon bug on the IWMC3200, where the
-                 * IOE timeout will cause problems on Moorestown
-                 * platforms (system hang). We explicitly overwrite
-                 * func->enable_timeout here to work around the issue.
-                 */
-                if (i2400ms->iwmc3200)
-                        func->enable_timeout = IWMC3200_IOR_TIMEOUT;
-                err = sdio_enable_func(func);
-                if (0 == err) {
-                        sdio_release_host(func);
-                        d_printf(2, dev, "SDIO function enabled\n");
-                        goto function_enabled;
-                }
-                d_printf(2, dev, "SDIO function failed to enable: %d\n", err);
-                sdio_release_host(func);
-                if (maxtries > 0 && ++tries >= maxtries) {
-                        err = -ETIME;
-                        break;
-                }
-                msleep(I2400MS_INIT_SLEEP_INTERVAL);
-        }
-        /* If timed out, device is not there yet -- get -ENODEV so
-         * the device driver core will retry later on. */
-        if (err == -ETIME) {
-                dev_err(dev, "Can't enable WiMAX function; "
-                        " has the function been enabled?\n");
-                err = -ENODEV;
-        }
-function_enabled:
-        d_fnend(3, dev, "(func %p) = %d\n", func, err);
-        return err;
-}
-/*
- * Setup minimal device communication infrastructure needed to at
- * least be able to update the firmware.
- *
- * Note the ugly trick: if we are in the probe path
- * (i2400ms->debugfs_dentry == NULL), we only retry function
- * enablement one, to avoid racing with the iwmc3200 top controller.
- */
-static
-int i2400ms_bus_setup(struct i2400m *i2400m)
-{
-        int result;
-        struct i2400ms *i2400ms =
-                container_of(i2400m, struct i2400ms, i2400m);
-        struct device *dev = i2400m_dev(i2400m);
-        struct sdio_func *func = i2400ms->func;
-        int retries;
-        sdio_claim_host(func);
-        result = sdio_set_block_size(func, I2400MS_BLK_SIZE);
-        sdio_release_host(func);
-        if (result < 0) {
-                dev_err(dev, "Failed to set block size: %d\n", result);
-                goto error_set_blk_size;
-        }
-        if (i2400ms->iwmc3200 && i2400ms->debugfs_dentry == NULL)
-                retries = 1;
-        else
-                retries = 0;
-        result = i2400ms_enable_function(i2400ms, retries);
-        if (result < 0) {
-                dev_err(dev, "Cannot enable SDIO function: %d\n", result);
-                goto error_func_enable;
-        }
-        result = i2400ms_tx_setup(i2400ms);
-        if (result < 0)
-                goto error_tx_setup;
-        result = i2400ms_rx_setup(i2400ms);
-        if (result < 0)
-                goto error_rx_setup;
-        return 0;
-error_rx_setup:
-        i2400ms_tx_release(i2400ms);
-error_tx_setup:
-        sdio_claim_host(func);
-        sdio_disable_func(func);
-        sdio_release_host(func);
-error_func_enable:
-error_set_blk_size:
-        return result;
-}
-/*
- * Tear down minimal device communication infrastructure needed to at
- * least be able to update the firmware.
- */
-static
-void i2400ms_bus_release(struct i2400m *i2400m)
-{
-        struct i2400ms *i2400ms =
-                container_of(i2400m, struct i2400ms, i2400m);
-        struct sdio_func *func = i2400ms->func;
-        i2400ms_rx_release(i2400ms);
-        i2400ms_tx_release(i2400ms);
-        sdio_claim_host(func);
-        sdio_disable_func(func);
-        sdio_release_host(func);
-}
-/*
- * Setup driver resources needed to communicate with the device
- *
- * The fw needs some time to settle, and it was just uploaded,
- * so give it a break first. I'd prefer to just wait for the device to
- * send something, but seems the poking we do to enable SDIO stuff
- * interferes with it, so just give it a break before starting...
- */
-static
-int i2400ms_bus_dev_start(struct i2400m *i2400m)
-{
-        struct i2400ms *i2400ms = container_of(i2400m, struct i2400ms, i2400m);
-        struct sdio_func *func = i2400ms->func;
-        struct device *dev = &func->dev;
-        d_fnstart(3, dev, "(i2400m %p)\n", i2400m);
-        msleep(200);
-        d_fnend(3, dev, "(i2400m %p) = %d\n", i2400m, 0);
-        return 0;
-}
-/*
- * Sends a barker buffer to the device
- *
- * This helper will allocate a kmalloced buffer and use it to transmit
- * (then free it). Reason for this is that the SDIO host controller
- * expects alignment (unknown exactly which) which the stack won't
- * really provide and certain arches/host-controller combinations
- * cannot use stack/vmalloc/text areas for DMA transfers.
- */
-static
-int __i2400ms_send_barker(struct i2400ms *i2400ms,
-                          const __le32 *barker, size_t barker_size)
-{
-        int  ret;
-        struct sdio_func *func = i2400ms->func;
-        struct device *dev = &func->dev;
-        void *buffer;
-        ret = -ENOMEM;
-        buffer = kmalloc(I2400MS_BLK_SIZE, GFP_KERNEL);
-        if (buffer == NULL)
-                goto error_kzalloc;
-        memcpy(buffer, barker, barker_size);
-        sdio_claim_host(func);
-        ret = sdio_memcpy_toio(func, 0, buffer, I2400MS_BLK_SIZE);
-        sdio_release_host(func);
-        if (ret < 0)
-                d_printf(0, dev, "E: barker error: %d\n", ret);
-        kfree(buffer);
-error_kzalloc:
-        return ret;
-}
-/*
- * Reset a device at different levels (warm, cold or bus)
- *
- * @i2400ms: device descriptor
- * @reset_type: soft, warm or bus reset (I2400M_RT_WARM/SOFT/BUS)
- *
- * FIXME: not tested -- need to confirm expected effects
- *
- * Warm and cold resets get an SDIO reset if they fail (unimplemented)
- *
- * Warm reset:
- *
- * The device will be fully reset internally, but won't be
- * disconnected from the bus (so no reenumeration will
- * happen). Firmware upload will be necessary.
- *
- * The device will send a reboot barker that will trigger the driver
- * to reinitialize the state via __i2400m_dev_reset_handle.
- *
- *
- * Cold and bus reset:
- *
- * The device will be fully reset internally, disconnected from the
- * bus an a reenumeration will happen. Firmware upload will be
- * necessary. Thus, we don't do any locking or struct
- * reinitialization, as we are going to be fully disconnected and
- * reenumerated.
- *
- * Note we need to return -ENODEV if a warm reset was requested and we
- * had to resort to a bus reset. See i2400m_op_reset(), wimax_reset()
- * and wimax_dev->op_reset.
- *
- * WARNING: no driver state saved/fixed
- */
-static
-int i2400ms_bus_reset(struct i2400m *i2400m, enum i2400m_reset_type rt)
-{
-        int result = 0;
-        struct i2400ms *i2400ms =
-                container_of(i2400m, struct i2400ms, i2400m);
-        struct device *dev = i2400m_dev(i2400m);
-        static const __le32 i2400m_WARM_BOOT_BARKER[4] = {
-                cpu_to_le32(I2400M_WARM_RESET_BARKER),
-                cpu_to_le32(I2400M_WARM_RESET_BARKER),
-                cpu_to_le32(I2400M_WARM_RESET_BARKER),
-                cpu_to_le32(I2400M_WARM_RESET_BARKER),
-        };
-        static const __le32 i2400m_COLD_BOOT_BARKER[4] = {
-                cpu_to_le32(I2400M_COLD_RESET_BARKER),
-                cpu_to_le32(I2400M_COLD_RESET_BARKER),
-                cpu_to_le32(I2400M_COLD_RESET_BARKER),
-                cpu_to_le32(I2400M_COLD_RESET_BARKER),
-        };
-        if (rt == I2400M_RT_WARM)
-                result = __i2400ms_send_barker(i2400ms, i2400m_WARM_BOOT_BARKER,
-                                               sizeof(i2400m_WARM_BOOT_BARKER));
-        else if (rt == I2400M_RT_COLD)
-                result = __i2400ms_send_barker(i2400ms, i2400m_COLD_BOOT_BARKER,
-                                               sizeof(i2400m_COLD_BOOT_BARKER));
-        else if (rt == I2400M_RT_BUS) {
-do_bus_reset:
-                i2400ms_bus_release(i2400m);
-                /* Wait for the device to settle */
-                msleep(40);
-                result =  i2400ms_bus_setup(i2400m);
-        } else
-                BUG();
-        if (result < 0 && rt != I2400M_RT_BUS) {
-                dev_err(dev, "%s reset failed (%d); trying SDIO reset\n",
-                        rt == I2400M_RT_WARM ? "warm" : "cold", result);
-                rt = I2400M_RT_BUS;
-                goto do_bus_reset;
-        }
-        return result;
-}
-static
-void i2400ms_netdev_setup(struct net_device *net_dev)
-{
-        struct i2400m *i2400m = net_dev_to_i2400m(net_dev);
-        struct i2400ms *i2400ms = container_of(i2400m, struct i2400ms, i2400m);
-        i2400ms_init(i2400ms);
-        i2400m_netdev_setup(net_dev);
-}
-/*
- * Debug levels control; see debug.h
- */
-struct d_level D_LEVEL[] = {
-        D_SUBMODULE_DEFINE(main),
-        D_SUBMODULE_DEFINE(tx),
-        D_SUBMODULE_DEFINE(rx),
-        D_SUBMODULE_DEFINE(fw),
-};
-size_t D_LEVEL_SIZE = ARRAY_SIZE(D_LEVEL);
-#define __debugfs_register(prefix, name, parent)                        \
-do {                                                                    \
-        result = d_level_register_debugfs(prefix, name, parent);        \
-        if (result < 0)                                                 \
-                goto error;                                             \
-} while (0)
-static
-int i2400ms_debugfs_add(struct i2400ms *i2400ms)
-{
-        int result;
-        struct dentry *dentry = i2400ms->i2400m.wimax_dev.debugfs_dentry;
-        dentry = debugfs_create_dir("i2400m-sdio", dentry);
-        result = PTR_ERR(dentry);
-        if (IS_ERR(dentry)) {
-                if (result == -ENODEV)
-                        result = 0;     /* No debugfs support */
-                goto error;
-        }
-        i2400ms->debugfs_dentry = dentry;
-        __debugfs_register("dl_", main, dentry);
-        __debugfs_register("dl_", tx, dentry);
-        __debugfs_register("dl_", rx, dentry);
-        __debugfs_register("dl_", fw, dentry);
-        return 0;
-error:
-        debugfs_remove_recursive(i2400ms->debugfs_dentry);
-        i2400ms->debugfs_dentry = NULL;
-        return result;
-}
-static struct device_type i2400ms_type = {
-        .name   = "wimax",
-};
-/*
- * Probe a i2400m interface and register it
- *
- * @func:    SDIO function
- * @id:      SDIO device ID
- * @returns: 0 if ok, < 0 errno code on error.
- *
- * Alloc a net device, initialize the bus-specific details and then
- * calls the bus-generic initialization routine. That will register
- * the wimax and netdev devices, upload the firmware [using
- * _bus_bm_*()], call _bus_dev_start() to finalize the setup of the
- * communication with the device and then will start to talk to it to
- * finnish setting it up.
- *
- * Initialization is tricky; some instances of the hw are packed with
- * others in a way that requires a third driver that enables the WiMAX
- * function. In those cases, we can't enable the SDIO function and
- * we'll return with -ENODEV. When the driver that enables the WiMAX
- * function does its thing, it has to do a bus_rescan_devices() on the
- * SDIO bus so this driver is called again to enumerate the WiMAX
- * function.
- */
-static
-int i2400ms_probe(struct sdio_func *func,
-                  const struct sdio_device_id *id)
-{
-        int result;
-        struct net_device *net_dev;
-        struct device *dev = &func->dev;
-        struct i2400m *i2400m;
-        struct i2400ms *i2400ms;
-        /* Allocate instance [calls i2400m_netdev_setup() on it]. */
-        result = -ENOMEM;
-        net_dev = alloc_netdev(sizeof(*i2400ms), "wmx%d",
-                               i2400ms_netdev_setup);
-        if (net_dev == NULL) {
-                dev_err(dev, "no memory for network device instance\n");
-                goto error_alloc_netdev;
-        }
-        SET_NETDEV_DEV(net_dev, dev);
-        SET_NETDEV_DEVTYPE(net_dev, &i2400ms_type);
-        i2400m = net_dev_to_i2400m(net_dev);
-        i2400ms = container_of(i2400m, struct i2400ms, i2400m);
-        i2400m->wimax_dev.net_dev = net_dev;
-        i2400ms->func = func;
-        sdio_set_drvdata(func, i2400ms);
-        i2400m->bus_tx_block_size = I2400MS_BLK_SIZE;
-        /*
-         * Room required in the TX queue for SDIO message to accommodate
-         * a smallest payload while allocating header space is 224 bytes,
-         * which is the smallest message size(the block size 256 bytes)
-         * minus the smallest message header size(32 bytes).
-         */
-        i2400m->bus_tx_room_min = I2400MS_BLK_SIZE - I2400M_PL_ALIGN * 2;
-        i2400m->bus_pl_size_max = I2400MS_PL_SIZE_MAX;
-        i2400m->bus_setup = i2400ms_bus_setup;
-        i2400m->bus_dev_start = i2400ms_bus_dev_start;
-        i2400m->bus_dev_stop = NULL;
-        i2400m->bus_release = i2400ms_bus_release;
-        i2400m->bus_tx_kick = i2400ms_bus_tx_kick;
-        i2400m->bus_reset = i2400ms_bus_reset;
-        /* The iwmc3200-wimax sometimes requires the driver to try
-         * hard when we paint it into a corner. */
-        i2400m->bus_bm_retries = I2400M_SDIO_BOOT_RETRIES;
-        i2400m->bus_bm_cmd_send = i2400ms_bus_bm_cmd_send;
-        i2400m->bus_bm_wait_for_ack = i2400ms_bus_bm_wait_for_ack;
-        i2400m->bus_fw_names = i2400ms_bus_fw_names;
-        i2400m->bus_bm_mac_addr_impaired = 1;
-        i2400m->bus_bm_pokes_table = &i2400ms_pokes[0];
-        switch (func->device) {
-        case SDIO_DEVICE_ID_INTEL_IWMC3200WIMAX:
-        case SDIO_DEVICE_ID_INTEL_IWMC3200WIMAX_2G5:
-                i2400ms->iwmc3200 = 1;
-                break;
-        default:
-                i2400ms->iwmc3200 = 0;
-        }
-        result = i2400m_setup(i2400m, I2400M_BRI_NO_REBOOT);
-        if (result < 0) {
-                dev_err(dev, "cannot setup device: %d\n", result);
-                goto error_setup;
-        }
-        result = i2400ms_debugfs_add(i2400ms);
-        if (result < 0) {
-                dev_err(dev, "cannot create SDIO debugfs: %d\n",
-                        result);
-                goto error_debugfs_add;
-        }
-        return 0;
-error_debugfs_add:
-        i2400m_release(i2400m);
-error_setup:
-        sdio_set_drvdata(func, NULL);
-        free_netdev(net_dev);
-error_alloc_netdev:
-        return result;
-}
-static
-void i2400ms_remove(struct sdio_func *func)
-{
-        struct device *dev = &func->dev;
-        struct i2400ms *i2400ms = sdio_get_drvdata(func);
-        struct i2400m *i2400m = &i2400ms->i2400m;
-        struct net_device *net_dev = i2400m->wimax_dev.net_dev;
-        d_fnstart(3, dev, "SDIO func %p\n", func);
-        debugfs_remove_recursive(i2400ms->debugfs_dentry);
-        i2400ms->debugfs_dentry = NULL;
-        i2400m_release(i2400m);
-        sdio_set_drvdata(func, NULL);
-        free_netdev(net_dev);
-        d_fnend(3, dev, "SDIO func %p\n", func);
-}
-static
-const struct sdio_device_id i2400ms_sdio_ids[] = {
-        /* Intel: i2400m WiMAX (iwmc3200) over SDIO */
-        { SDIO_DEVICE(SDIO_VENDOR_ID_INTEL,
-                      SDIO_DEVICE_ID_INTEL_IWMC3200WIMAX) },
-        { SDIO_DEVICE(SDIO_VENDOR_ID_INTEL,
-                      SDIO_DEVICE_ID_INTEL_IWMC3200WIMAX_2G5) },
-        { /* end: all zeroes */ },
-};
-MODULE_DEVICE_TABLE(sdio, i2400ms_sdio_ids);
-static
-struct sdio_driver i2400m_sdio_driver = {
-        .name           = KBUILD_MODNAME,
-        .probe          = i2400ms_probe,
-        .remove         = i2400ms_remove,
-        .id_table       = i2400ms_sdio_ids,
-};
-static
-int __init i2400ms_driver_init(void)
-{
-        d_parse_params(D_LEVEL, D_LEVEL_SIZE, i2400ms_debug_params,
-                       "i2400m_sdio.debug");
-        return sdio_register_driver(&i2400m_sdio_driver);
-}
-module_init(i2400ms_driver_init);
-static
-void __exit i2400ms_driver_exit(void)
-{
-        sdio_unregister_driver(&i2400m_sdio_driver);
-}
-module_exit(i2400ms_driver_exit);
-MODULE_AUTHOR("Intel Corporation <linux-wimax@intel.com>");
-MODULE_DESCRIPTION("Intel 2400M WiMAX networking for SDIO");
-MODULE_LICENSE("GPL");
-MODULE_FIRMWARE(I2400MS_FW_FILE_NAME);
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index 5f58fa53238c..6deaae18db57 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -276,7 +276,6 @@ source "drivers/net/wireless/hostap/Kconfig"
 source "drivers/net/wireless/ipw2x00/Kconfig"
 source "drivers/net/wireless/iwlwifi/Kconfig"
 source "drivers/net/wireless/iwlegacy/Kconfig"
-source "drivers/net/wireless/iwmc3200wifi/Kconfig"
 source "drivers/net/wireless/libertas/Kconfig"
 source "drivers/net/wireless/orinoco/Kconfig"
 source "drivers/net/wireless/p54/Kconfig"
diff --git a/drivers/net/wireless/Makefile b/drivers/net/wireless/Makefile
index 0ce218b931d4..062dfdff6364 100644
--- a/drivers/net/wireless/Makefile
+++ b/drivers/net/wireless/Makefile
@@ -53,8 +53,6 @@ obj-$(CONFIG_MAC80211_HWSIM)	+= mac80211_hwsim.o
 obj-$(CONFIG_WL_TI)     += ti/
-obj-$(CONFIG_IWM)       += iwmc3200wifi/
 obj-$(CONFIG_MWIFIEX)   += mwifiex/
 obj-$(CONFIG_BRCMFMAC)  += brcm80211/
diff --git a/drivers/net/wireless/ath/ath5k/Kconfig b/drivers/net/wireless/ath/ath5k/Kconfig
index e18a9aa7b6ca..338c5c42357d 100644
--- a/drivers/net/wireless/ath/ath5k/Kconfig
+++ b/drivers/net/wireless/ath/ath5k/Kconfig
@@ -64,3 +64,11 @@ config ATH5K_PCI
        ---help---
          This adds support for PCI type chipsets of the 5xxx Atheros
          family.
+config ATH5K_TEST_CHANNELS
+        bool "Enables testing channels on ath5k"
+        depends on ATH5K && CFG80211_CERTIFICATION_ONUS
+        ---help---
+          This enables non-standard IEEE 802.11 channels on ath5k, which
+          can be used for research purposes. This option should be disabled
+          unless doing research.
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 44ad6fe0278f..8c4c040a47b8 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -74,10 +74,6 @@ bool ath5k_modparam_nohwcrypt;
 module_param_named(nohwcrypt, ath5k_modparam_nohwcrypt, bool, S_IRUGO);
 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
-static bool modparam_all_channels;
-module_param_named(all_channels, modparam_all_channels, bool, S_IRUGO);
-MODULE_PARM_DESC(all_channels, "Expose all channels the device can use.");
 static bool modparam_fastchanswitch;
 module_param_named(fastchanswitch, modparam_fastchanswitch, bool, S_IRUGO);
 MODULE_PARM_DESC(fastchanswitch, "Enable fast channel switching for AR2413/AR5413 radios.");
@@ -258,8 +254,15 @@ static int ath5k_reg_notifier(struct wiphy *wiphy, struct regulatory_request *re
 \********************/
 /*
- * Returns true for the channel numbers used without all_channels modparam.
+ * Returns true for the channel numbers used.
 */
+#ifdef CONFIG_ATH5K_TEST_CHANNELS
+static bool ath5k_is_standard_channel(short chan, enum ieee80211_band band)
+{
+        return true;
+}
+#else
 static bool ath5k_is_standard_channel(short chan, enum ieee80211_band band)
 {
        if (band == IEEE80211_BAND_2GHZ && chan <= 14)
@@ -276,6 +279,7 @@ static bool ath5k_is_standard_channel(short chan, enum ieee80211_band band)
                /* 802.11j 4.9GHz (20MHz) */
                (chan == 184 || chan == 188 || chan == 192 || chan == 196));
 }
+#endif
 static unsigned int
 ath5k_setup_channels(struct ath5k_hw *ah, struct ieee80211_channel *channels,
@@ -316,8 +320,7 @@ ath5k_setup_channels(struct ath5k_hw *ah, struct ieee80211_channel *channels,
                if (!ath5k_channel_ok(ah, &channels[count]))
                        continue;
-                if (!modparam_all_channels &&
+                if (!ath5k_is_standard_channel(ch, band))
-                    !ath5k_is_standard_channel(ch, band))
                        continue;
                count++;
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index fd7dbd4609df..aca1d2689e90 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -3627,6 +3627,7 @@ int ath6kl_cfg80211_init(struct ath6kl *ar)
        wiphy->cipher_suites = cipher_suites;
        wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
+#ifdef CONFIG_PM
        wiphy->wowlan.flags = WIPHY_WOWLAN_MAGIC_PKT |
                              WIPHY_WOWLAN_DISCONNECT |
                              WIPHY_WOWLAN_GTK_REKEY_FAILURE  |
@@ -3636,6 +3637,7 @@ int ath6kl_cfg80211_init(struct ath6kl *ar)
        wiphy->wowlan.n_patterns = WOW_MAX_FILTERS_PER_LIST;
        wiphy->wowlan.pattern_min_len = 1;
        wiphy->wowlan.pattern_max_len = WOW_PATTERN_SIZE;
+#endif
        wiphy->max_sched_scan_ssids = MAX_PROBED_SSIDS;
diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
index 4a4e8a2b9d2c..3a69804f4c16 100644
--- a/drivers/net/wireless/ath/ath9k/ahb.c
+++ b/drivers/net/wireless/ath/ath9k/ahb.c
@@ -35,6 +35,10 @@ static const struct platform_device_id ath9k_platform_id_table[] = {
                .name = "ar934x_wmac",
                .driver_data = AR9300_DEVID_AR9340,
        },
+        {
+                .name = "qca955x_wmac",
+                .driver_data = AR9300_DEVID_QCA955X,
+        },
        {},
 };
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index d7deb8c9f299..84b558d126ca 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -159,14 +159,11 @@ static bool ar9003_hw_calibrate(struct ath_hw *ah,
                }
        }
-        /* Do NF cal only at longer intervals */
+        /*
-        if (longcal) {
+         * Do NF cal only at longer intervals. Get the value from
-                /*
+         * the previous NF cal and update history buffer.
-                 * Get the value from the previous NF cal and update
+         */
-                 * history buffer.
+        if (longcal && ath9k_hw_getnf(ah, chan)) {
-                 */
-                ath9k_hw_getnf(ah, chan);
                /*
                 * Load the NF from history buffer of the current channel.
                 * NF is slow time-variant, so it is OK to use a historical
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index b1e59236d245..ab2bfcb3bed2 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -3509,7 +3509,7 @@ static void ar9003_hw_xpa_bias_level_apply(struct ath_hw *ah, bool is2ghz)
        if (AR_SREV_9485(ah) || AR_SREV_9330(ah) || AR_SREV_9340(ah))
                REG_RMW_FIELD(ah, AR_CH0_TOP2, AR_CH0_TOP2_XPABIASLVL, bias);
-        else if (AR_SREV_9462(ah))
+        else if (AR_SREV_9462(ah) || AR_SREV_9550(ah))
                REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, bias);
        else {
                REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, bias);
@@ -3591,6 +3591,9 @@ static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
        if (AR_SREV_9462(ah)) {
                REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM,
                                AR_SWITCH_TABLE_COM_AR9462_ALL, value);
+        } else if (AR_SREV_9550(ah)) {
+                REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM,
+                                AR_SWITCH_TABLE_COM_AR9550_ALL, value);
        } else
                REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM,
                              AR_SWITCH_TABLE_COM_ALL, value);
@@ -3957,7 +3960,7 @@ static void ath9k_hw_ar9300_set_board_values(struct ath_hw *ah,
        ar9003_hw_drive_strength_apply(ah);
        ar9003_hw_atten_apply(ah, chan);
        ar9003_hw_quick_drop_apply(ah, chan->channel);
-        if (!AR_SREV_9330(ah) && !AR_SREV_9340(ah))
+        if (!AR_SREV_9330(ah) && !AR_SREV_9340(ah) && !AR_SREV_9550(ah))
                ar9003_hw_internal_regulator_apply(ah);
        if (AR_SREV_9485(ah) || AR_SREV_9330(ah) || AR_SREV_9340(ah))
                ar9003_hw_apply_tuning_caps(ah);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index a0e3394b10dc..41e88c660e48 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -21,6 +21,7 @@
 #include "ar9340_initvals.h"
 #include "ar9330_1p1_initvals.h"
 #include "ar9330_1p2_initvals.h"
+#include "ar955x_1p0_initvals.h"
 #include "ar9580_1p0_initvals.h"
 #include "ar9462_2p0_initvals.h"
@@ -327,7 +328,61 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
                INIT_INI_ARRAY(&ah->ini_japan2484, AR9462_BBC_TXIFR_COEFFJ,
                                ARRAY_SIZE(AR9462_BBC_TXIFR_COEFFJ), 2);
+        } else if (AR_SREV_9550(ah)) {
+                /* mac */
+                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_PRE], NULL, 0, 0);
+                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
+                                ar955x_1p0_mac_core,
+                                ARRAY_SIZE(ar955x_1p0_mac_core), 2);
+                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_POST],
+                                ar955x_1p0_mac_postamble,
+                                ARRAY_SIZE(ar955x_1p0_mac_postamble), 5);
+                /* bb */
+                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_PRE], NULL, 0, 0);
+                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_CORE],
+                                ar955x_1p0_baseband_core,
+                                ARRAY_SIZE(ar955x_1p0_baseband_core), 2);
+                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_POST],
+                                ar955x_1p0_baseband_postamble,
+                                ARRAY_SIZE(ar955x_1p0_baseband_postamble), 5);
+                /* radio */
+                INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_PRE], NULL, 0, 0);
+                INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_CORE],
+                                ar955x_1p0_radio_core,
+                                ARRAY_SIZE(ar955x_1p0_radio_core), 2);
+                INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_POST],
+                                ar955x_1p0_radio_postamble,
+                                ARRAY_SIZE(ar955x_1p0_radio_postamble), 5);
+                /* soc */
+                INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_PRE],
+                                ar955x_1p0_soc_preamble,
+                                ARRAY_SIZE(ar955x_1p0_soc_preamble), 2);
+                INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_CORE], NULL, 0, 0);
+                INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_POST],
+                                ar955x_1p0_soc_postamble,
+                                ARRAY_SIZE(ar955x_1p0_soc_postamble), 5);
+                /* rx/tx gain */
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                        ar955x_1p0_common_wo_xlna_rx_gain_table,
+                        ARRAY_SIZE(ar955x_1p0_common_wo_xlna_rx_gain_table),
+                        2);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                        ar955x_1p0_common_wo_xlna_rx_gain_bounds,
+                        ARRAY_SIZE(ar955x_1p0_common_wo_xlna_rx_gain_bounds),
+                        5);
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                ar955x_1p0_modes_xpa_tx_gain_table,
+                                ARRAY_SIZE(ar955x_1p0_modes_xpa_tx_gain_table),
+                                9);
+                /* Fast clock modal settings */
+                INIT_INI_ARRAY(&ah->iniModesFastClock,
+                                ar955x_1p0_modes_fast_clock,
+                                ARRAY_SIZE(ar955x_1p0_modes_fast_clock), 3);
        } else if (AR_SREV_9580(ah)) {
                /* mac */
                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_PRE], NULL, 0, 0);
@@ -470,6 +525,11 @@ static void ar9003_tx_gain_table_mode0(struct ath_hw *ah)
                        ar9485_modes_lowest_ob_db_tx_gain_1_1,
                        ARRAY_SIZE(ar9485_modes_lowest_ob_db_tx_gain_1_1),
                        5);
+        else if (AR_SREV_9550(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                        ar955x_1p0_modes_xpa_tx_gain_table,
+                        ARRAY_SIZE(ar955x_1p0_modes_xpa_tx_gain_table),
+                        9);
        else if (AR_SREV_9580(ah))
                INIT_INI_ARRAY(&ah->iniModesTxGain,
                        ar9580_1p0_lowest_ob_db_tx_gain_table,
@@ -514,6 +574,11 @@ static void ar9003_tx_gain_table_mode1(struct ath_hw *ah)
                        ar9580_1p0_high_ob_db_tx_gain_table,
                        ARRAY_SIZE(ar9580_1p0_high_ob_db_tx_gain_table),
                        5);
+        else if (AR_SREV_9550(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                        ar955x_1p0_modes_no_xpa_tx_gain_table,
+                        ARRAY_SIZE(ar955x_1p0_modes_no_xpa_tx_gain_table),
+                        9);
        else if (AR_SREV_9462_20(ah))
                INIT_INI_ARRAY(&ah->iniModesTxGain,
                        ar9462_modes_high_ob_db_tx_gain_table_2p0,
@@ -635,7 +700,16 @@ static void ar9003_rx_gain_table_mode0(struct ath_hw *ah)
                                ar9485Common_wo_xlna_rx_gain_1_1,
                                ARRAY_SIZE(ar9485Common_wo_xlna_rx_gain_1_1),
                                2);
-        else if (AR_SREV_9580(ah))
+        else if (AR_SREV_9550(ah)) {
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                                ar955x_1p0_common_rx_gain_table,
+                                ARRAY_SIZE(ar955x_1p0_common_rx_gain_table),
+                                2);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                                ar955x_1p0_common_rx_gain_bounds,
+                                ARRAY_SIZE(ar955x_1p0_common_rx_gain_bounds),
+                                5);
+        } else if (AR_SREV_9580(ah))
                INIT_INI_ARRAY(&ah->iniModesRxGain,
                                ar9580_1p0_rx_gain_table,
                                ARRAY_SIZE(ar9580_1p0_rx_gain_table),
@@ -679,7 +753,16 @@ static void ar9003_rx_gain_table_mode1(struct ath_hw *ah)
                        ar9462_common_wo_xlna_rx_gain_table_2p0,
                        ARRAY_SIZE(ar9462_common_wo_xlna_rx_gain_table_2p0),
                        2);
-        else if (AR_SREV_9580(ah))
+        else if (AR_SREV_9550(ah)) {
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                        ar955x_1p0_common_wo_xlna_rx_gain_table,
+                        ARRAY_SIZE(ar955x_1p0_common_wo_xlna_rx_gain_table),
+                        2);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                        ar955x_1p0_common_wo_xlna_rx_gain_bounds,
+                        ARRAY_SIZE(ar955x_1p0_common_wo_xlna_rx_gain_bounds),
+                        5);
+        } else if (AR_SREV_9580(ah))
                INIT_INI_ARRAY(&ah->iniModesRxGain,
                        ar9580_1p0_wo_xlna_rx_gain_table,
                        ARRAY_SIZE(ar9580_1p0_wo_xlna_rx_gain_table),
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mci.c b/drivers/net/wireless/ath/ath9k/ar9003_mci.c
index 61558375bfbf..9a34fcaae3ff 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mci.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mci.c
@@ -1015,12 +1015,9 @@ void ar9003_mci_2g5g_switch(struct ath_hw *ah, bool force)
                return;
        if (mci->is_2g) {
-                if (!force) {
+                ar9003_mci_send_2g5g_status(ah, true);
-                        ar9003_mci_send_2g5g_status(ah, true);
+                ar9003_mci_send_lna_transfer(ah, true);
+                udelay(5);
-                        ar9003_mci_send_lna_transfer(ah, true);
-                        udelay(5);
-                }
                REG_CLR_BIT(ah, AR_MCI_TX_CTRL,
                            AR_MCI_TX_CTRL_DISABLE_LNA_UPDATE);
@@ -1030,10 +1027,8 @@ void ar9003_mci_2g5g_switch(struct ath_hw *ah, bool force)
                if (!(mci->config & ATH_MCI_CONFIG_DISABLE_OSLA))
                        ar9003_mci_osla_setup(ah, true);
        } else {
-                if (!force) {
+                ar9003_mci_send_lna_take(ah, true);
-                        ar9003_mci_send_lna_take(ah, true);
+                udelay(5);
-                        udelay(5);
-                }
                REG_SET_BIT(ah, AR_MCI_TX_CTRL,
                            AR_MCI_TX_CTRL_DISABLE_LNA_UPDATE);
@@ -1041,8 +1036,7 @@ void ar9003_mci_2g5g_switch(struct ath_hw *ah, bool force)
                            AR_BTCOEX_CTRL_BT_OWN_SPDT_CTRL);
                ar9003_mci_osla_setup(ah, false);
-                if (!force)
+                ar9003_mci_send_2g5g_status(ah, true);
-                        ar9003_mci_send_2g5g_status(ah, true);
        }
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
index 3d400e8d6535..2c9f7d7ed4cc 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
@@ -211,7 +211,7 @@ static int ar9003_paprd_setup_single_table(struct ath_hw *ah)
                      AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_NUM_CORR_STAGES, 7);
        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL3,
                      AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_MIN_LOOPBACK_DEL, 1);
-        if (AR_SREV_9485(ah) || AR_SREV_9462(ah))
+        if (AR_SREV_9485(ah) || AR_SREV_9462(ah) || AR_SREV_9550(ah))
                REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL3,
                              AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_QUICK_DROP,
                              -3);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 6b91ebb158fe..d2346dbad6cd 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -99,7 +99,7 @@ static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
                        channelSel = (freq * 4) / 120;
                        chan_frac = (((freq * 4) % 120) * 0x20000) / 120;
                        channelSel = (channelSel << 17) | chan_frac;
-                } else if (AR_SREV_9340(ah)) {
+                } else if (AR_SREV_9340(ah) || AR_SREV_9550(ah)) {
                        if (ah->is_clk_25mhz) {
                                u32 chan_frac;
@@ -113,7 +113,8 @@ static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
                /* Set to 2G mode */
                bMode = 1;
        } else {
-                if (AR_SREV_9340(ah) && ah->is_clk_25mhz) {
+                if ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) &&
+                    ah->is_clk_25mhz) {
                        u32 chan_frac;
                        channelSel = (freq * 2) / 75;
@@ -180,7 +181,8 @@ static void ar9003_hw_spur_mitigate_mrc_cck(struct ath_hw *ah,
         * is out-of-band and can be ignored.
         */
-        if (AR_SREV_9485(ah) || AR_SREV_9340(ah) || AR_SREV_9330(ah)) {
+        if (AR_SREV_9485(ah) || AR_SREV_9340(ah) || AR_SREV_9330(ah) ||
+            AR_SREV_9550(ah)) {
                if (spur_fbin_ptr[0] == 0) /* No spur */
                        return;
                max_spur_cnts = 5;
@@ -205,7 +207,8 @@ static void ar9003_hw_spur_mitigate_mrc_cck(struct ath_hw *ah,
                if (AR_SREV_9462(ah) && (i == 0 || i == 3))
                        continue;
                negative = 0;
-                if (AR_SREV_9485(ah) || AR_SREV_9340(ah) || AR_SREV_9330(ah))
+                if (AR_SREV_9485(ah) || AR_SREV_9340(ah) || AR_SREV_9330(ah) ||
+                    AR_SREV_9550(ah))
                        cur_bb_spur = ath9k_hw_fbin2freq(spur_fbin_ptr[i],
                                                         IS_CHAN_2GHZ(chan));
                else
@@ -618,6 +621,50 @@ static void ar9003_hw_prog_ini(struct ath_hw *ah,
        }
 }
+static int ar9550_hw_get_modes_txgain_index(struct ath_hw *ah,
+                                            struct ath9k_channel *chan)
+{
+        int ret;
+        switch (chan->chanmode) {
+        case CHANNEL_A:
+        case CHANNEL_A_HT20:
+                if (chan->channel <= 5350)
+                        ret = 1;
+                else if ((chan->channel > 5350) && (chan->channel <= 5600))
+                        ret = 3;
+                else
+                        ret = 5;
+                break;
+        case CHANNEL_A_HT40PLUS:
+        case CHANNEL_A_HT40MINUS:
+                if (chan->channel <= 5350)
+                        ret = 2;
+                else if ((chan->channel > 5350) && (chan->channel <= 5600))
+                        ret = 4;
+                else
+                        ret = 6;
+                break;
+        case CHANNEL_G:
+        case CHANNEL_G_HT20:
+        case CHANNEL_B:
+                ret = 8;
+                break;
+        case CHANNEL_G_HT40PLUS:
+        case CHANNEL_G_HT40MINUS:
+                ret = 7;
+                break;
+        default:
+                ret = -EINVAL;
+        }
+        return ret;
+}
 static int ar9003_hw_process_ini(struct ath_hw *ah,
                                 struct ath9k_channel *chan)
 {
@@ -659,7 +706,22 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
        }
        REG_WRITE_ARRAY(&ah->iniModesRxGain, 1, regWrites);
-        REG_WRITE_ARRAY(&ah->iniModesTxGain, modesIndex, regWrites);
+        if (AR_SREV_9550(ah))
+                REG_WRITE_ARRAY(&ah->ini_modes_rx_gain_bounds, modesIndex,
+                                regWrites);
+        if (AR_SREV_9550(ah)) {
+                int modes_txgain_index;
+                modes_txgain_index = ar9550_hw_get_modes_txgain_index(ah, chan);
+                if (modes_txgain_index < 0)
+                        return -EINVAL;
+                REG_WRITE_ARRAY(&ah->iniModesTxGain, modes_txgain_index,
+                                regWrites);
+        } else {
+                REG_WRITE_ARRAY(&ah->iniModesTxGain, modesIndex, regWrites);
+        }
        /*
         * For 5GHz channels requiring Fast Clock, apply
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index ed662c3bae5b..751c83b21493 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -636,8 +636,8 @@
 #define AR_CH0_TOP      (AR_SREV_9300(ah) ? 0x16288 : \
                                ((AR_SREV_9462(ah) ? 0x1628c : 0x16280)))
-#define AR_CH0_TOP_XPABIASLVL (0x300)
+#define AR_CH0_TOP_XPABIASLVL (AR_SREV_9550(ah) ? 0x3c0 : 0x300)
-#define AR_CH0_TOP_XPABIASLVL_S (8)
+#define AR_CH0_TOP_XPABIASLVL_S (AR_SREV_9550(ah) ? 6 : 8)
 #define AR_CH0_THERM    (AR_SREV_9300(ah) ? 0x16290 : \
                                ((AR_SREV_9485(ah) ? 0x1628c : 0x16294)))
@@ -650,6 +650,8 @@
 #define AR_SWITCH_TABLE_COM_ALL_S (0)
 #define AR_SWITCH_TABLE_COM_AR9462_ALL (0xffffff)
 #define AR_SWITCH_TABLE_COM_AR9462_ALL_S (0)
+#define AR_SWITCH_TABLE_COM_AR9550_ALL (0xffffff)
+#define AR_SWITCH_TABLE_COM_AR9550_ALL_S (0)
 #define AR_SWITCH_TABLE_COM_SPDT (0x00f00000)
 #define AR_SWITCH_TABLE_COM_SPDT_ALL (0x0000fff0)
 #define AR_SWITCH_TABLE_COM_SPDT_ALL_S (4)
diff --git a/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
new file mode 100644
index 000000000000..df97f21c52dc
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
@@ -0,0 +1,1284 @@
+/*
+ * Copyright (c) 2010-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef INITVALS_955X_1P0_H
+#define INITVALS_955X_1P0_H
+/* AR955X 1.0 */
+static const u32 ar955x_1p0_radio_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00016098, 0xd2dd5554, 0xd2dd5554, 0xd28b3330, 0xd28b3330},
+        {0x0001609c, 0x0a566f3a, 0x0a566f3a, 0x06345f2a, 0x06345f2a},
+        {0x000160ac, 0xa4647c00, 0xa4647c00, 0xa4646800, 0xa4646800},
+        {0x000160b0, 0x01885f52, 0x01885f52, 0x04accf3a, 0x04accf3a},
+        {0x00016104, 0xb7a00001, 0xb7a00001, 0xb7a00001, 0xb7a00001},
+        {0x0001610c, 0xc0000000, 0xc0000000, 0xc0000000, 0xc0000000},
+        {0x00016140, 0x10804008, 0x10804008, 0x10804008, 0x10804008},
+        {0x00016504, 0xb7a00001, 0xb7a00001, 0xb7a00001, 0xb7a00001},
+        {0x0001650c, 0xc0000000, 0xc0000000, 0xc0000000, 0xc0000000},
+        {0x00016540, 0x10804008, 0x10804008, 0x10804008, 0x10804008},
+        {0x00016904, 0xb7a00001, 0xb7a00001, 0xb7a00001, 0xb7a00001},
+        {0x0001690c, 0xc0000000, 0xc0000000, 0xc0000000, 0xc0000000},
+        {0x00016940, 0x10804008, 0x10804008, 0x10804008, 0x10804008},
+};
+static const u32 ar955x_1p0_baseband_core_txfir_coeff_japan_2484[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a398, 0x00000000},
+        {0x0000a39c, 0x6f7f0301},
+        {0x0000a3a0, 0xca9228ee},
+};
+static const u32 ar955x_1p0_baseband_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a8011},
+        {0x00009820, 0x206a022e, 0x206a022e, 0x206a012e, 0x206a012e},
+        {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0},
+        {0x00009828, 0x06903081, 0x06903081, 0x06903881, 0x06903881},
+        {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
+        {0x00009830, 0x0000059c, 0x0000059c, 0x0000119c, 0x0000119c},
+        {0x00009c00, 0x000000c4, 0x000000c4, 0x000000c4, 0x000000c4},
+        {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x037216a0},
+        {0x00009e04, 0x001c2020, 0x001c2020, 0x001c2020, 0x001c2020},
+        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000e2},
+        {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec84d2e},
+        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3379605e, 0x33795d5e},
+        {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
+        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
+        {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
+        {0x00009e3c, 0xcfa10820, 0xcfa10820, 0xcfa10822, 0xcfa10822},
+        {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
+        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
+        {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
+        {0x0000a204, 0x005c0ec0, 0x005c0ec4, 0x005c0ec4, 0x005c0ec0},
+        {0x0000a208, 0x00000104, 0x00000104, 0x00000004, 0x00000004},
+        {0x0000a22c, 0x07e26a2f, 0x07e26a2f, 0x01026a2f, 0x01026a2f},
+        {0x0000a230, 0x0000000a, 0x00000014, 0x00000016, 0x0000000b},
+        {0x0000a234, 0x00000fff, 0x10000fff, 0x10000fff, 0x00000fff},
+        {0x0000a238, 0xffb01018, 0xffb01018, 0xffb01018, 0xffb01018},
+        {0x0000a250, 0x00000000, 0x00000000, 0x00000210, 0x00000108},
+        {0x0000a254, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898},
+        {0x0000a258, 0x02020002, 0x02020002, 0x02020002, 0x02020002},
+        {0x0000a25c, 0x01000e0e, 0x01000e0e, 0x01000e0e, 0x01000e0e},
+        {0x0000a260, 0x0a021501, 0x0a021501, 0x3a021501, 0x3a021501},
+        {0x0000a264, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e},
+        {0x0000a280, 0x00000007, 0x00000007, 0x0000000b, 0x0000000b},
+        {0x0000a284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
+        {0x0000a288, 0x00000110, 0x00000110, 0x00000110, 0x00000110},
+        {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
+        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
+        {0x0000a2cc, 0x18c50033, 0x18c43433, 0x18c41033, 0x18c44c33},
+        {0x0000a2d0, 0x00041982, 0x00041982, 0x00041982, 0x00041982},
+        {0x0000a2d8, 0x7999a83b, 0x7999a83b, 0x7999a83b, 0x7999a83b},
+        {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x001c0000},
+        {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
+        {0x0000b284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
+        {0x0000b830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000be04, 0x001c0000, 0x001c0000, 0x001c0000, 0x001c0000},
+        {0x0000be18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000be1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000be20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
+        {0x0000c284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
+};
+static const u32 ar955x_1p0_radio_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00016000, 0x36db6db6},
+        {0x00016004, 0x6db6db40},
+        {0x00016008, 0x73f00000},
+        {0x0001600c, 0x00000000},
+        {0x00016040, 0x7f80fff8},
+        {0x0001604c, 0x76d005b5},
+        {0x00016050, 0x557cf031},
+        {0x00016054, 0x13449440},
+        {0x00016058, 0x0c51c92c},
+        {0x0001605c, 0x3db7fffc},
+        {0x00016060, 0xfffffffc},
+        {0x00016064, 0x000f0278},
+        {0x00016068, 0x6db6db6c},
+        {0x0001606c, 0x6db60000},
+        {0x00016080, 0x00080000},
+        {0x00016084, 0x0e48048c},
+        {0x00016088, 0x14214514},
+        {0x0001608c, 0x119f101e},
+        {0x00016090, 0x24926490},
+        {0x00016094, 0x00000000},
+        {0x000160a0, 0x0a108ffe},
+        {0x000160a4, 0x812fc370},
+        {0x000160a8, 0x423c8000},
+        {0x000160b4, 0x92480080},
+        {0x000160c0, 0x006db6d0},
+        {0x000160c4, 0x6db6db60},
+        {0x000160c8, 0x6db6db6c},
+        {0x000160cc, 0x01e6c000},
+        {0x00016100, 0x11999601},
+        {0x00016108, 0x00080010},
+        {0x00016144, 0x02084080},
+        {0x00016148, 0x000080c0},
+        {0x00016280, 0x01800804},
+        {0x00016284, 0x00038dc5},
+        {0x00016288, 0x00000000},
+        {0x0001628c, 0x00000040},
+        {0x00016380, 0x00000000},
+        {0x00016384, 0x00000000},
+        {0x00016388, 0x00400705},
+        {0x0001638c, 0x00800700},
+        {0x00016390, 0x00800700},
+        {0x00016394, 0x00000000},
+        {0x00016398, 0x00000000},
+        {0x0001639c, 0x00000000},
+        {0x000163a0, 0x00000001},
+        {0x000163a4, 0x00000001},
+        {0x000163a8, 0x00000000},
+        {0x000163ac, 0x00000000},
+        {0x000163b0, 0x00000000},
+        {0x000163b4, 0x00000000},
+        {0x000163b8, 0x00000000},
+        {0x000163bc, 0x00000000},
+        {0x000163c0, 0x000000a0},
+        {0x000163c4, 0x000c0000},
+        {0x000163c8, 0x14021402},
+        {0x000163cc, 0x00001402},
+        {0x000163d0, 0x00000000},
+        {0x000163d4, 0x00000000},
+        {0x00016400, 0x36db6db6},
+        {0x00016404, 0x6db6db40},
+        {0x00016408, 0x73f00000},
+        {0x0001640c, 0x00000000},
+        {0x00016440, 0x7f80fff8},
+        {0x0001644c, 0x76d005b5},
+        {0x00016450, 0x557cf031},
+        {0x00016454, 0x13449440},
+        {0x00016458, 0x0c51c92c},
+        {0x0001645c, 0x3db7fffc},
+        {0x00016460, 0xfffffffc},
+        {0x00016464, 0x000f0278},
+        {0x00016468, 0x6db6db6c},
+        {0x0001646c, 0x6db60000},
+        {0x00016500, 0x11999601},
+        {0x00016508, 0x00080010},
+        {0x00016544, 0x02084080},
+        {0x00016548, 0x000080c0},
+        {0x00016780, 0x00000000},
+        {0x00016784, 0x00000000},
+        {0x00016788, 0x00400705},
+        {0x0001678c, 0x00800700},
+        {0x00016790, 0x00800700},
+        {0x00016794, 0x00000000},
+        {0x00016798, 0x00000000},
+        {0x0001679c, 0x00000000},
+        {0x000167a0, 0x00000001},
+        {0x000167a4, 0x00000001},
+        {0x000167a8, 0x00000000},
+        {0x000167ac, 0x00000000},
+        {0x000167b0, 0x00000000},
+        {0x000167b4, 0x00000000},
+        {0x000167b8, 0x00000000},
+        {0x000167bc, 0x00000000},
+        {0x000167c0, 0x000000a0},
+        {0x000167c4, 0x000c0000},
+        {0x000167c8, 0x14021402},
+        {0x000167cc, 0x00001402},
+        {0x000167d0, 0x00000000},
+        {0x000167d4, 0x00000000},
+        {0x00016800, 0x36db6db6},
+        {0x00016804, 0x6db6db40},
+        {0x00016808, 0x73f00000},
+        {0x0001680c, 0x00000000},
+        {0x00016840, 0x7f80fff8},
+        {0x0001684c, 0x76d005b5},
+        {0x00016850, 0x557cf031},
+        {0x00016854, 0x13449440},
+        {0x00016858, 0x0c51c92c},
+        {0x0001685c, 0x3db7fffc},
+        {0x00016860, 0xfffffffc},
+        {0x00016864, 0x000f0278},
+        {0x00016868, 0x6db6db6c},
+        {0x0001686c, 0x6db60000},
+        {0x00016900, 0x11999601},
+        {0x00016908, 0x00080010},
+        {0x00016944, 0x02084080},
+        {0x00016948, 0x000080c0},
+        {0x00016b80, 0x00000000},
+        {0x00016b84, 0x00000000},
+        {0x00016b88, 0x00400705},
+        {0x00016b8c, 0x00800700},
+        {0x00016b90, 0x00800700},
+        {0x00016b94, 0x00000000},
+        {0x00016b98, 0x00000000},
+        {0x00016b9c, 0x00000000},
+        {0x00016ba0, 0x00000001},
+        {0x00016ba4, 0x00000001},
+        {0x00016ba8, 0x00000000},
+        {0x00016bac, 0x00000000},
+        {0x00016bb0, 0x00000000},
+        {0x00016bb4, 0x00000000},
+        {0x00016bb8, 0x00000000},
+        {0x00016bbc, 0x00000000},
+        {0x00016bc0, 0x000000a0},
+        {0x00016bc4, 0x000c0000},
+        {0x00016bc8, 0x14021402},
+        {0x00016bcc, 0x00001402},
+        {0x00016bd0, 0x00000000},
+        {0x00016bd4, 0x00000000},
+};
+static const u32 ar955x_1p0_modes_xpa_tx_gain_table[][9] = {
+        /* Addr      5G_HT20_L   5G_HT40_L   5G_HT20_M   5G_HT40_M   5G_HT20_H   5G_HT40_H   2G_HT40     2G_HT20  */
+        {0x0000a2dc, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xfffd5aaa, 0xfffd5aaa},
+        {0x0000a2e0, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xfffe9ccc, 0xfffe9ccc},
+        {0x0000a2e4, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xffffe0f0, 0xffffe0f0},
+        {0x0000a2e8, 0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00, 0xfffcff00, 0xfffcff00},
+        {0x0000a410, 0x000050de, 0x000050de, 0x000050de, 0x000050de, 0x000050de, 0x000050de, 0x000050da, 0x000050da},
+        {0x0000a500, 0x00000003, 0x00000003, 0x00000003, 0x00000003, 0x00000003, 0x00000003, 0x00000000, 0x00000000},
+        {0x0000a504, 0x04000005, 0x04000005, 0x04000005, 0x04000005, 0x04000005, 0x04000005, 0x04000002, 0x04000002},
+        {0x0000a508, 0x08000009, 0x08000009, 0x08000009, 0x08000009, 0x08000009, 0x08000009, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x0c00000b, 0x0c00000b, 0x0c00000b, 0x0c00000b, 0x0c00000b, 0x0c00000b, 0x0c000006, 0x0c000006},
+        {0x0000a510, 0x1000000d, 0x1000000d, 0x1000000d, 0x1000000d, 0x1000000d, 0x1000000d, 0x0f00000a, 0x0f00000a},
+        {0x0000a514, 0x14000011, 0x14000011, 0x14000011, 0x14000011, 0x14000011, 0x14000011, 0x1300000c, 0x1300000c},
+        {0x0000a518, 0x19004008, 0x19004008, 0x19004008, 0x19004008, 0x18004008, 0x18004008, 0x1700000e, 0x1700000e},
+        {0x0000a51c, 0x1d00400a, 0x1d00400a, 0x1d00400a, 0x1d00400a, 0x1c00400a, 0x1c00400a, 0x1b000064, 0x1b000064},
+        {0x0000a520, 0x230020a2, 0x230020a2, 0x210020a2, 0x210020a2, 0x200020a2, 0x200020a2, 0x1f000242, 0x1f000242},
+        {0x0000a524, 0x2500006e, 0x2500006e, 0x2500006e, 0x2500006e, 0x2400006e, 0x2400006e, 0x23000229, 0x23000229},
+        {0x0000a528, 0x29022221, 0x29022221, 0x28022221, 0x28022221, 0x27022221, 0x27022221, 0x270002a2, 0x270002a2},
+        {0x0000a52c, 0x2d00062a, 0x2d00062a, 0x2c00062a, 0x2c00062a, 0x2a00062a, 0x2a00062a, 0x2c001203, 0x2c001203},
+        {0x0000a530, 0x340220a5, 0x340220a5, 0x320220a5, 0x320220a5, 0x2f0220a5, 0x2f0220a5, 0x30001803, 0x30001803},
+        {0x0000a534, 0x380022c5, 0x380022c5, 0x350022c5, 0x350022c5, 0x320022c5, 0x320022c5, 0x33000881, 0x33000881},
+        {0x0000a538, 0x3b002486, 0x3b002486, 0x39002486, 0x39002486, 0x36002486, 0x36002486, 0x38001809, 0x38001809},
+        {0x0000a53c, 0x3f00248a, 0x3f00248a, 0x3d00248a, 0x3d00248a, 0x3a00248a, 0x3a00248a, 0x3a000814, 0x3a000814},
+        {0x0000a540, 0x4202242c, 0x4202242c, 0x4102242c, 0x4102242c, 0x3f02242c, 0x3f02242c, 0x3f001a0c, 0x3f001a0c},
+        {0x0000a544, 0x490044c6, 0x490044c6, 0x460044c6, 0x460044c6, 0x420044c6, 0x420044c6, 0x43001a0e, 0x43001a0e},
+        {0x0000a548, 0x4d024485, 0x4d024485, 0x4a024485, 0x4a024485, 0x46024485, 0x46024485, 0x46001812, 0x46001812},
+        {0x0000a54c, 0x51044483, 0x51044483, 0x4e044483, 0x4e044483, 0x4a044483, 0x4a044483, 0x49001884, 0x49001884},
+        {0x0000a550, 0x5404a40c, 0x5404a40c, 0x5204a40c, 0x5204a40c, 0x4d04a40c, 0x4d04a40c, 0x4d001e84, 0x4d001e84},
+        {0x0000a554, 0x57024632, 0x57024632, 0x55024632, 0x55024632, 0x52024632, 0x52024632, 0x50001e69, 0x50001e69},
+        {0x0000a558, 0x5c00a634, 0x5c00a634, 0x5900a634, 0x5900a634, 0x5600a634, 0x5600a634, 0x550006f4, 0x550006f4},
+        {0x0000a55c, 0x5f026832, 0x5f026832, 0x5d026832, 0x5d026832, 0x5a026832, 0x5a026832, 0x59000ad3, 0x59000ad3},
+        {0x0000a560, 0x6602b012, 0x6602b012, 0x6202b012, 0x6202b012, 0x5d02b012, 0x5d02b012, 0x5e000ad5, 0x5e000ad5},
+        {0x0000a564, 0x6e02d0e1, 0x6e02d0e1, 0x6802d0e1, 0x6802d0e1, 0x6002d0e1, 0x6002d0e1, 0x61001ced, 0x61001ced},
+        {0x0000a568, 0x7202b4c4, 0x7202b4c4, 0x6c02b4c4, 0x6c02b4c4, 0x6502b4c4, 0x6502b4c4, 0x660018d4, 0x660018d4},
+        {0x0000a56c, 0x75007894, 0x75007894, 0x70007894, 0x70007894, 0x6b007894, 0x6b007894, 0x660018d4, 0x660018d4},
+        {0x0000a570, 0x7b025c74, 0x7b025c74, 0x75025c74, 0x75025c74, 0x70025c74, 0x70025c74, 0x660018d4, 0x660018d4},
+        {0x0000a574, 0x8300bcb5, 0x8300bcb5, 0x7a00bcb5, 0x7a00bcb5, 0x7600bcb5, 0x7600bcb5, 0x660018d4, 0x660018d4},
+        {0x0000a578, 0x8a04dc74, 0x8a04dc74, 0x7f04dc74, 0x7f04dc74, 0x7c04dc74, 0x7c04dc74, 0x660018d4, 0x660018d4},
+        {0x0000a57c, 0x8a04dc74, 0x8a04dc74, 0x7f04dc74, 0x7f04dc74, 0x7c04dc74, 0x7c04dc74, 0x660018d4, 0x660018d4},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x03804000, 0x03804000},
+        {0x0000a610, 0x04c08c01, 0x04c08c01, 0x04808b01, 0x04808b01, 0x04808a01, 0x04808a01, 0x0300ca02, 0x0300ca02},
+        {0x0000a614, 0x00c0c303, 0x00c0c303, 0x00c0c303, 0x00c0c303, 0x00c0c303, 0x00c0c303, 0x00000e04, 0x00000e04},
+        {0x0000a618, 0x04010c01, 0x04010c01, 0x03c10b01, 0x03c10b01, 0x03810a01, 0x03810a01, 0x03014000, 0x03014000},
+        {0x0000a61c, 0x03814e05, 0x03814e05, 0x03414d05, 0x03414d05, 0x03414d05, 0x03414d05, 0x00000000, 0x00000000},
+        {0x0000a620, 0x04010303, 0x04010303, 0x03c10303, 0x03c10303, 0x03810303, 0x03810303, 0x00000000, 0x00000000},
+        {0x0000a624, 0x03814e05, 0x03814e05, 0x03414d05, 0x03414d05, 0x03414d05, 0x03414d05, 0x03014000, 0x03014000},
+        {0x0000a628, 0x00c0c000, 0x00c0c000, 0x00c0c000, 0x00c0c000, 0x00c0c000, 0x00c0c000, 0x03804c05, 0x03804c05},
+        {0x0000a62c, 0x00c0c303, 0x00c0c303, 0x00c0c303, 0x00c0c303, 0x00c0c303, 0x00c0c303, 0x0701de06, 0x0701de06},
+        {0x0000a630, 0x03418000, 0x03418000, 0x03018000, 0x03018000, 0x02c18000, 0x02c18000, 0x07819c07, 0x07819c07},
+        {0x0000a634, 0x03815004, 0x03815004, 0x03414f04, 0x03414f04, 0x03414e04, 0x03414e04, 0x0701dc07, 0x0701dc07},
+        {0x0000a638, 0x03005302, 0x03005302, 0x02c05202, 0x02c05202, 0x02805202, 0x02805202, 0x0701dc07, 0x0701dc07},
+        {0x0000a63c, 0x04c09302, 0x04c09302, 0x04809202, 0x04809202, 0x04809202, 0x04809202, 0x0701dc07, 0x0701dc07},
+        {0x0000b2dc, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xfffd5aaa, 0xfffd5aaa},
+        {0x0000b2e0, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xfffe9ccc, 0xfffe9ccc},
+        {0x0000b2e4, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xffffe0f0, 0xffffe0f0},
+        {0x0000b2e8, 0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00, 0xfffcff00, 0xfffcff00},
+        {0x0000c2dc, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xfffd5aaa, 0xfffd5aaa},
+        {0x0000c2e0, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xfffe9ccc, 0xfffe9ccc},
+        {0x0000c2e4, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xffffe0f0, 0xffffe0f0},
+        {0x0000c2e8, 0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00, 0xfffcff00, 0xfffcff00},
+        {0x00016044, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x010002d4, 0x010002d4},
+        {0x00016048, 0x62482401, 0x62482401, 0x62482401, 0x62482401, 0x62482401, 0x62482401, 0x66482401, 0x66482401},
+        {0x00016280, 0x01801e84, 0x01801e84, 0x01801e84, 0x01801e84, 0x01801e84, 0x01801e84, 0x01808e84, 0x01808e84},
+        {0x00016444, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x010002d4, 0x010002d4},
+        {0x00016448, 0x62482401, 0x62482401, 0x62482401, 0x62482401, 0x62482401, 0x62482401, 0x66482401, 0x66482401},
+        {0x00016844, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x010002d4, 0x010002d4},
+        {0x00016848, 0x62482401, 0x62482401, 0x62482401, 0x62482401, 0x62482401, 0x62482401, 0x66482401, 0x66482401},
+};
+static const u32 ar955x_1p0_mac_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00000008, 0x00000000},
+        {0x00000030, 0x00020085},
+        {0x00000034, 0x00000005},
+        {0x00000040, 0x00000000},
+        {0x00000044, 0x00000000},
+        {0x00000048, 0x00000008},
+        {0x0000004c, 0x00000010},
+        {0x00000050, 0x00000000},
+        {0x00001040, 0x002ffc0f},
+        {0x00001044, 0x002ffc0f},
+        {0x00001048, 0x002ffc0f},
+        {0x0000104c, 0x002ffc0f},
+        {0x00001050, 0x002ffc0f},
+        {0x00001054, 0x002ffc0f},
+        {0x00001058, 0x002ffc0f},
+        {0x0000105c, 0x002ffc0f},
+        {0x00001060, 0x002ffc0f},
+        {0x00001064, 0x002ffc0f},
+        {0x000010f0, 0x00000100},
+        {0x00001270, 0x00000000},
+        {0x000012b0, 0x00000000},
+        {0x000012f0, 0x00000000},
+        {0x0000143c, 0x00000000},
+        {0x0000147c, 0x00000000},
+        {0x00008000, 0x00000000},
+        {0x00008004, 0x00000000},
+        {0x00008008, 0x00000000},
+        {0x0000800c, 0x00000000},
+        {0x00008018, 0x00000000},
+        {0x00008020, 0x00000000},
+        {0x00008038, 0x00000000},
+        {0x0000803c, 0x00000000},
+        {0x00008040, 0x00000000},
+        {0x00008044, 0x00000000},
+        {0x00008048, 0x00000000},
+        {0x0000804c, 0xffffffff},
+        {0x00008054, 0x00000000},
+        {0x00008058, 0x00000000},
+        {0x0000805c, 0x000fc78f},
+        {0x00008060, 0x0000000f},
+        {0x00008064, 0x00000000},
+        {0x00008070, 0x00000310},
+        {0x00008074, 0x00000020},
+        {0x00008078, 0x00000000},
+        {0x0000809c, 0x0000000f},
+        {0x000080a0, 0x00000000},
+        {0x000080a4, 0x02ff0000},
+        {0x000080a8, 0x0e070605},
+        {0x000080ac, 0x0000000d},
+        {0x000080b0, 0x00000000},
+        {0x000080b4, 0x00000000},
+        {0x000080b8, 0x00000000},
+        {0x000080bc, 0x00000000},
+        {0x000080c0, 0x2a800000},
+        {0x000080c4, 0x06900168},
+        {0x000080c8, 0x13881c22},
+        {0x000080cc, 0x01f40000},
+        {0x000080d0, 0x00252500},
+        {0x000080d4, 0x00a00000},
+        {0x000080d8, 0x00400000},
+        {0x000080dc, 0x00000000},
+        {0x000080e0, 0xffffffff},
+        {0x000080e4, 0x0000ffff},
+        {0x000080e8, 0x3f3f3f3f},
+        {0x000080ec, 0x00000000},
+        {0x000080f0, 0x00000000},
+        {0x000080f4, 0x00000000},
+        {0x000080fc, 0x00020000},
+        {0x00008100, 0x00000000},
+        {0x00008108, 0x00000052},
+        {0x0000810c, 0x00000000},
+        {0x00008110, 0x00000000},
+        {0x00008114, 0x000007ff},
+        {0x00008118, 0x000000aa},
+        {0x0000811c, 0x00003210},
+        {0x00008124, 0x00000000},
+        {0x00008128, 0x00000000},
+        {0x0000812c, 0x00000000},
+        {0x00008130, 0x00000000},
+        {0x00008134, 0x00000000},
+        {0x00008138, 0x00000000},
+        {0x0000813c, 0x0000ffff},
+        {0x00008140, 0x000000fe},
+        {0x00008144, 0xffffffff},
+        {0x00008168, 0x00000000},
+        {0x0000816c, 0x00000000},
+        {0x000081c0, 0x00000000},
+        {0x000081c4, 0x33332210},
+        {0x000081ec, 0x00000000},
+        {0x000081f0, 0x00000000},
+        {0x000081f4, 0x00000000},
+        {0x000081f8, 0x00000000},
+        {0x000081fc, 0x00000000},
+        {0x00008240, 0x00100000},
+        {0x00008244, 0x0010f400},
+        {0x00008248, 0x00000800},
+        {0x0000824c, 0x0001e800},
+        {0x00008250, 0x00000000},
+        {0x00008254, 0x00000000},
+        {0x00008258, 0x00000000},
+        {0x0000825c, 0x40000000},
+        {0x00008260, 0x00080922},
+        {0x00008264, 0x9d400010},
+        {0x00008268, 0xffffffff},
+        {0x0000826c, 0x0000ffff},
+        {0x00008270, 0x00000000},
+        {0x00008274, 0x40000000},
+        {0x00008278, 0x003e4180},
+        {0x0000827c, 0x00000004},
+        {0x00008284, 0x0000002c},
+        {0x00008288, 0x0000002c},
+        {0x0000828c, 0x000000ff},
+        {0x00008294, 0x00000000},
+        {0x00008298, 0x00000000},
+        {0x0000829c, 0x00000000},
+        {0x00008300, 0x00001d40},
+        {0x00008314, 0x00000000},
+        {0x0000831c, 0x0000010d},
+        {0x00008328, 0x00000000},
+        {0x0000832c, 0x0000001f},
+        {0x00008330, 0x00000302},
+        {0x00008334, 0x00000700},
+        {0x00008338, 0xffff0000},
+        {0x0000833c, 0x02400000},
+        {0x00008340, 0x000107ff},
+        {0x00008344, 0xaa48107b},
+        {0x00008348, 0x008f0000},
+        {0x0000835c, 0x00000000},
+        {0x00008360, 0xffffffff},
+        {0x00008364, 0xffffffff},
+        {0x00008368, 0x00000000},
+        {0x00008370, 0x00000000},
+        {0x00008374, 0x000000ff},
+        {0x00008378, 0x00000000},
+        {0x0000837c, 0x00000000},
+        {0x00008380, 0xffffffff},
+        {0x00008384, 0xffffffff},
+        {0x00008390, 0xffffffff},
+        {0x00008394, 0xffffffff},
+        {0x00008398, 0x00000000},
+        {0x0000839c, 0x00000000},
+        {0x000083a0, 0x00000000},
+        {0x000083a4, 0x0000fa14},
+        {0x000083a8, 0x000f0c00},
+        {0x000083ac, 0x33332210},
+        {0x000083b0, 0x33332210},
+        {0x000083b4, 0x33332210},
+        {0x000083b8, 0x33332210},
+        {0x000083bc, 0x00000000},
+        {0x000083c0, 0x00000000},
+        {0x000083c4, 0x00000000},
+        {0x000083c8, 0x00000000},
+        {0x000083cc, 0x00000200},
+        {0x000083d0, 0x8c7901ff},
+};
+static const u32 ar955x_1p0_common_rx_gain_table[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a000, 0x00010000},
+        {0x0000a004, 0x00030002},
+        {0x0000a008, 0x00050004},
+        {0x0000a00c, 0x00810080},
+        {0x0000a010, 0x00830082},
+        {0x0000a014, 0x01810180},
+        {0x0000a018, 0x01830182},
+        {0x0000a01c, 0x01850184},
+        {0x0000a020, 0x01890188},
+        {0x0000a024, 0x018b018a},
+        {0x0000a028, 0x018d018c},
+        {0x0000a02c, 0x01910190},
+        {0x0000a030, 0x01930192},
+        {0x0000a034, 0x01950194},
+        {0x0000a038, 0x038a0196},
+        {0x0000a03c, 0x038c038b},
+        {0x0000a040, 0x0390038d},
+        {0x0000a044, 0x03920391},
+        {0x0000a048, 0x03940393},
+        {0x0000a04c, 0x03960395},
+        {0x0000a050, 0x00000000},
+        {0x0000a054, 0x00000000},
+        {0x0000a058, 0x00000000},
+        {0x0000a05c, 0x00000000},
+        {0x0000a060, 0x00000000},
+        {0x0000a064, 0x00000000},
+        {0x0000a068, 0x00000000},
+        {0x0000a06c, 0x00000000},
+        {0x0000a070, 0x00000000},
+        {0x0000a074, 0x00000000},
+        {0x0000a078, 0x00000000},
+        {0x0000a07c, 0x00000000},
+        {0x0000a080, 0x22222229},
+        {0x0000a084, 0x1d1d1d1d},
+        {0x0000a088, 0x1d1d1d1d},
+        {0x0000a08c, 0x1d1d1d1d},
+        {0x0000a090, 0x171d1d1d},
+        {0x0000a094, 0x11111717},
+        {0x0000a098, 0x00030311},
+        {0x0000a09c, 0x00000000},
+        {0x0000a0a0, 0x00000000},
+        {0x0000a0a4, 0x00000000},
+        {0x0000a0a8, 0x00000000},
+        {0x0000a0ac, 0x00000000},
+        {0x0000a0b0, 0x00000000},
+        {0x0000a0b4, 0x00000000},
+        {0x0000a0b8, 0x00000000},
+        {0x0000a0bc, 0x00000000},
+        {0x0000a0c0, 0x001f0000},
+        {0x0000a0c4, 0x01000101},
+        {0x0000a0c8, 0x011e011f},
+        {0x0000a0cc, 0x011c011d},
+        {0x0000a0d0, 0x02030204},
+        {0x0000a0d4, 0x02010202},
+        {0x0000a0d8, 0x021f0200},
+        {0x0000a0dc, 0x0302021e},
+        {0x0000a0e0, 0x03000301},
+        {0x0000a0e4, 0x031e031f},
+        {0x0000a0e8, 0x0402031d},
+        {0x0000a0ec, 0x04000401},
+        {0x0000a0f0, 0x041e041f},
+        {0x0000a0f4, 0x0502041d},
+        {0x0000a0f8, 0x05000501},
+        {0x0000a0fc, 0x051e051f},
+        {0x0000a100, 0x06010602},
+        {0x0000a104, 0x061f0600},
+        {0x0000a108, 0x061d061e},
+        {0x0000a10c, 0x07020703},
+        {0x0000a110, 0x07000701},
+        {0x0000a114, 0x00000000},
+        {0x0000a118, 0x00000000},
+        {0x0000a11c, 0x00000000},
+        {0x0000a120, 0x00000000},
+        {0x0000a124, 0x00000000},
+        {0x0000a128, 0x00000000},
+        {0x0000a12c, 0x00000000},
+        {0x0000a130, 0x00000000},
+        {0x0000a134, 0x00000000},
+        {0x0000a138, 0x00000000},
+        {0x0000a13c, 0x00000000},
+        {0x0000a140, 0x001f0000},
+        {0x0000a144, 0x01000101},
+        {0x0000a148, 0x011e011f},
+        {0x0000a14c, 0x011c011d},
+        {0x0000a150, 0x02030204},
+        {0x0000a154, 0x02010202},
+        {0x0000a158, 0x021f0200},
+        {0x0000a15c, 0x0302021e},
+        {0x0000a160, 0x03000301},
+        {0x0000a164, 0x031e031f},
+        {0x0000a168, 0x0402031d},
+        {0x0000a16c, 0x04000401},
+        {0x0000a170, 0x041e041f},
+        {0x0000a174, 0x0502041d},
+        {0x0000a178, 0x05000501},
+        {0x0000a17c, 0x051e051f},
+        {0x0000a180, 0x06010602},
+        {0x0000a184, 0x061f0600},
+        {0x0000a188, 0x061d061e},
+        {0x0000a18c, 0x07020703},
+        {0x0000a190, 0x07000701},
+        {0x0000a194, 0x00000000},
+        {0x0000a198, 0x00000000},
+        {0x0000a19c, 0x00000000},
+        {0x0000a1a0, 0x00000000},
+        {0x0000a1a4, 0x00000000},
+        {0x0000a1a8, 0x00000000},
+        {0x0000a1ac, 0x00000000},
+        {0x0000a1b0, 0x00000000},
+        {0x0000a1b4, 0x00000000},
+        {0x0000a1b8, 0x00000000},
+        {0x0000a1bc, 0x00000000},
+        {0x0000a1c0, 0x00000000},
+        {0x0000a1c4, 0x00000000},
+        {0x0000a1c8, 0x00000000},
+        {0x0000a1cc, 0x00000000},
+        {0x0000a1d0, 0x00000000},
+        {0x0000a1d4, 0x00000000},
+        {0x0000a1d8, 0x00000000},
+        {0x0000a1dc, 0x00000000},
+        {0x0000a1e0, 0x00000000},
+        {0x0000a1e4, 0x00000000},
+        {0x0000a1e8, 0x00000000},
+        {0x0000a1ec, 0x00000000},
+        {0x0000a1f0, 0x00000396},
+        {0x0000a1f4, 0x00000396},
+        {0x0000a1f8, 0x00000396},
+        {0x0000a1fc, 0x00000196},
+        {0x0000b000, 0x00010000},
+        {0x0000b004, 0x00030002},
+        {0x0000b008, 0x00050004},
+        {0x0000b00c, 0x00810080},
+        {0x0000b010, 0x00830082},
+        {0x0000b014, 0x01810180},
+        {0x0000b018, 0x01830182},
+        {0x0000b01c, 0x01850184},
+        {0x0000b020, 0x02810280},
+        {0x0000b024, 0x02830282},
+        {0x0000b028, 0x02850284},
+        {0x0000b02c, 0x02890288},
+        {0x0000b030, 0x028b028a},
+        {0x0000b034, 0x0388028c},
+        {0x0000b038, 0x038a0389},
+        {0x0000b03c, 0x038c038b},
+        {0x0000b040, 0x0390038d},
+        {0x0000b044, 0x03920391},
+        {0x0000b048, 0x03940393},
+        {0x0000b04c, 0x03960395},
+        {0x0000b050, 0x00000000},
+        {0x0000b054, 0x00000000},
+        {0x0000b058, 0x00000000},
+        {0x0000b05c, 0x00000000},
+        {0x0000b060, 0x00000000},
+        {0x0000b064, 0x00000000},
+        {0x0000b068, 0x00000000},
+        {0x0000b06c, 0x00000000},
+        {0x0000b070, 0x00000000},
+        {0x0000b074, 0x00000000},
+        {0x0000b078, 0x00000000},
+        {0x0000b07c, 0x00000000},
+        {0x0000b080, 0x23232323},
+        {0x0000b084, 0x21232323},
+        {0x0000b088, 0x19191c1e},
+        {0x0000b08c, 0x12141417},
+        {0x0000b090, 0x07070e0e},
+        {0x0000b094, 0x03030305},
+        {0x0000b098, 0x00000003},
+        {0x0000b09c, 0x00000000},
+        {0x0000b0a0, 0x00000000},
+        {0x0000b0a4, 0x00000000},
+        {0x0000b0a8, 0x00000000},
+        {0x0000b0ac, 0x00000000},
+        {0x0000b0b0, 0x00000000},
+        {0x0000b0b4, 0x00000000},
+        {0x0000b0b8, 0x00000000},
+        {0x0000b0bc, 0x00000000},
+        {0x0000b0c0, 0x003f0020},
+        {0x0000b0c4, 0x00400041},
+        {0x0000b0c8, 0x0140005f},
+        {0x0000b0cc, 0x0160015f},
+        {0x0000b0d0, 0x017e017f},
+        {0x0000b0d4, 0x02410242},
+        {0x0000b0d8, 0x025f0240},
+        {0x0000b0dc, 0x027f0260},
+        {0x0000b0e0, 0x0341027e},
+        {0x0000b0e4, 0x035f0340},
+        {0x0000b0e8, 0x037f0360},
+        {0x0000b0ec, 0x04400441},
+        {0x0000b0f0, 0x0460045f},
+        {0x0000b0f4, 0x0541047f},
+        {0x0000b0f8, 0x055f0540},
+        {0x0000b0fc, 0x057f0560},
+        {0x0000b100, 0x06400641},
+        {0x0000b104, 0x0660065f},
+        {0x0000b108, 0x067e067f},
+        {0x0000b10c, 0x07410742},
+        {0x0000b110, 0x075f0740},
+        {0x0000b114, 0x077f0760},
+        {0x0000b118, 0x07800781},
+        {0x0000b11c, 0x07a0079f},
+        {0x0000b120, 0x07c107bf},
+        {0x0000b124, 0x000007c0},
+        {0x0000b128, 0x00000000},
+        {0x0000b12c, 0x00000000},
+        {0x0000b130, 0x00000000},
+        {0x0000b134, 0x00000000},
+        {0x0000b138, 0x00000000},
+        {0x0000b13c, 0x00000000},
+        {0x0000b140, 0x003f0020},
+        {0x0000b144, 0x00400041},
+        {0x0000b148, 0x0140005f},
+        {0x0000b14c, 0x0160015f},
+        {0x0000b150, 0x017e017f},
+        {0x0000b154, 0x02410242},
+        {0x0000b158, 0x025f0240},
+        {0x0000b15c, 0x027f0260},
+        {0x0000b160, 0x0341027e},
+        {0x0000b164, 0x035f0340},
+        {0x0000b168, 0x037f0360},
+        {0x0000b16c, 0x04400441},
+        {0x0000b170, 0x0460045f},
+        {0x0000b174, 0x0541047f},
+        {0x0000b178, 0x055f0540},
+        {0x0000b17c, 0x057f0560},
+        {0x0000b180, 0x06400641},
+        {0x0000b184, 0x0660065f},
+        {0x0000b188, 0x067e067f},
+        {0x0000b18c, 0x07410742},
+        {0x0000b190, 0x075f0740},
+        {0x0000b194, 0x077f0760},
+        {0x0000b198, 0x07800781},
+        {0x0000b19c, 0x07a0079f},
+        {0x0000b1a0, 0x07c107bf},
+        {0x0000b1a4, 0x000007c0},
+        {0x0000b1a8, 0x00000000},
+        {0x0000b1ac, 0x00000000},
+        {0x0000b1b0, 0x00000000},
+        {0x0000b1b4, 0x00000000},
+        {0x0000b1b8, 0x00000000},
+        {0x0000b1bc, 0x00000000},
+        {0x0000b1c0, 0x00000000},
+        {0x0000b1c4, 0x00000000},
+        {0x0000b1c8, 0x00000000},
+        {0x0000b1cc, 0x00000000},
+        {0x0000b1d0, 0x00000000},
+        {0x0000b1d4, 0x00000000},
+        {0x0000b1d8, 0x00000000},
+        {0x0000b1dc, 0x00000000},
+        {0x0000b1e0, 0x00000000},
+        {0x0000b1e4, 0x00000000},
+        {0x0000b1e8, 0x00000000},
+        {0x0000b1ec, 0x00000000},
+        {0x0000b1f0, 0x00000396},
+        {0x0000b1f4, 0x00000396},
+        {0x0000b1f8, 0x00000396},
+        {0x0000b1fc, 0x00000196},
+};
+static const u32 ar955x_1p0_baseband_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00009800, 0xafe68e30},
+        {0x00009804, 0xfd14e000},
+        {0x00009808, 0x9c0a9f6b},
+        {0x0000980c, 0x04900000},
+        {0x00009814, 0x0280c00a},
+        {0x00009818, 0x00000000},
+        {0x0000981c, 0x00020028},
+        {0x00009834, 0x6400a190},
+        {0x00009838, 0x0108ecff},
+        {0x0000983c, 0x14000600},
+        {0x00009880, 0x201fff00},
+        {0x00009884, 0x00001042},
+        {0x000098a4, 0x00200400},
+        {0x000098b0, 0x32840bbe},
+        {0x000098bc, 0x00000002},
+        {0x000098d0, 0x004b6a8e},
+        {0x000098d4, 0x00000820},
+        {0x000098dc, 0x00000000},
+        {0x000098f0, 0x00000000},
+        {0x000098f4, 0x00000000},
+        {0x00009c04, 0xff55ff55},
+        {0x00009c08, 0x0320ff55},
+        {0x00009c0c, 0x00000000},
+        {0x00009c10, 0x00000000},
+        {0x00009c14, 0x00046384},
+        {0x00009c18, 0x05b6b440},
+        {0x00009c1c, 0x00b6b440},
+        {0x00009d00, 0xc080a333},
+        {0x00009d04, 0x40206c10},
+        {0x00009d08, 0x009c4060},
+        {0x00009d0c, 0x9883800a},
+        {0x00009d10, 0x01834061},
+        {0x00009d14, 0x00c0040b},
+        {0x00009d18, 0x00000000},
+        {0x00009e08, 0x0038230c},
+        {0x00009e24, 0x990bb515},
+        {0x00009e28, 0x0c6f0000},
+        {0x00009e30, 0x06336f77},
+        {0x00009e34, 0x6af6532f},
+        {0x00009e38, 0x0cc80c00},
+        {0x00009e40, 0x0d261820},
+        {0x00009e4c, 0x00001004},
+        {0x00009e50, 0x00ff03f1},
+        {0x00009fc0, 0x813e4788},
+        {0x00009fc4, 0x0001efb5},
+        {0x00009fcc, 0x40000014},
+        {0x00009fd0, 0x01193b93},
+        {0x0000a20c, 0x00000000},
+        {0x0000a220, 0x00000000},
+        {0x0000a224, 0x00000000},
+        {0x0000a228, 0x10002310},
+        {0x0000a23c, 0x00000000},
+        {0x0000a244, 0x0c000000},
+        {0x0000a248, 0x00000140},
+        {0x0000a2a0, 0x00000007},
+        {0x0000a2c0, 0x00000007},
+        {0x0000a2c8, 0x00000000},
+        {0x0000a2d4, 0x00000000},
+        {0x0000a2ec, 0x00000000},
+        {0x0000a2f0, 0x00000000},
+        {0x0000a2f4, 0x00000000},
+        {0x0000a2f8, 0x00000000},
+        {0x0000a344, 0x00000000},
+        {0x0000a34c, 0x00000000},
+        {0x0000a350, 0x0000a000},
+        {0x0000a364, 0x00000000},
+        {0x0000a370, 0x00000000},
+        {0x0000a390, 0x00000001},
+        {0x0000a394, 0x00000444},
+        {0x0000a398, 0x1f020503},
+        {0x0000a39c, 0x29180c03},
+        {0x0000a3a0, 0x9a8b6844},
+        {0x0000a3a4, 0x00000000},
+        {0x0000a3a8, 0xaaaaaaaa},
+        {0x0000a3ac, 0x3c466478},
+        {0x0000a3c0, 0x20202020},
+        {0x0000a3c4, 0x22222220},
+        {0x0000a3c8, 0x20200020},
+        {0x0000a3cc, 0x20202020},
+        {0x0000a3d0, 0x20202020},
+        {0x0000a3d4, 0x20202020},
+        {0x0000a3d8, 0x20202020},
+        {0x0000a3dc, 0x20202020},
+        {0x0000a3e0, 0x20202020},
+        {0x0000a3e4, 0x20202020},
+        {0x0000a3e8, 0x20202020},
+        {0x0000a3ec, 0x20202020},
+        {0x0000a3f0, 0x00000000},
+        {0x0000a3f4, 0x00000000},
+        {0x0000a3f8, 0x0c9bd380},
+        {0x0000a3fc, 0x000f0f01},
+        {0x0000a400, 0x8fa91f01},
+        {0x0000a404, 0x00000000},
+        {0x0000a408, 0x0e79e5c6},
+        {0x0000a40c, 0x00820820},
+        {0x0000a414, 0x1ce739ce},
+        {0x0000a418, 0x2d001dce},
+        {0x0000a41c, 0x1ce739ce},
+        {0x0000a420, 0x000001ce},
+        {0x0000a424, 0x1ce739ce},
+        {0x0000a428, 0x000001ce},
+        {0x0000a42c, 0x1ce739ce},
+        {0x0000a430, 0x1ce739ce},
+        {0x0000a434, 0x00000000},
+        {0x0000a438, 0x00001801},
+        {0x0000a43c, 0x00100000},
+        {0x0000a444, 0x00000000},
+        {0x0000a448, 0x05000080},
+        {0x0000a44c, 0x00000001},
+        {0x0000a450, 0x00010000},
+        {0x0000a458, 0x00000000},
+        {0x0000a644, 0x3fad9d74},
+        {0x0000a648, 0x0048060a},
+        {0x0000a64c, 0x00003c37},
+        {0x0000a670, 0x03020100},
+        {0x0000a674, 0x09080504},
+        {0x0000a678, 0x0d0c0b0a},
+        {0x0000a67c, 0x13121110},
+        {0x0000a680, 0x31301514},
+        {0x0000a684, 0x35343332},
+        {0x0000a688, 0x00000036},
+        {0x0000a690, 0x00000838},
+        {0x0000a7cc, 0x00000000},
+        {0x0000a7d0, 0x00000000},
+        {0x0000a7d4, 0x00000004},
+        {0x0000a7dc, 0x00000000},
+        {0x0000a8d0, 0x004b6a8e},
+        {0x0000a8d4, 0x00000820},
+        {0x0000a8dc, 0x00000000},
+        {0x0000a8f0, 0x00000000},
+        {0x0000a8f4, 0x00000000},
+        {0x0000b2d0, 0x00000080},
+        {0x0000b2d4, 0x00000000},
+        {0x0000b2ec, 0x00000000},
+        {0x0000b2f0, 0x00000000},
+        {0x0000b2f4, 0x00000000},
+        {0x0000b2f8, 0x00000000},
+        {0x0000b408, 0x0e79e5c0},
+        {0x0000b40c, 0x00820820},
+        {0x0000b420, 0x00000000},
+        {0x0000b8d0, 0x004b6a8e},
+        {0x0000b8d4, 0x00000820},
+        {0x0000b8dc, 0x00000000},
+        {0x0000b8f0, 0x00000000},
+        {0x0000b8f4, 0x00000000},
+        {0x0000c2d0, 0x00000080},
+        {0x0000c2d4, 0x00000000},
+        {0x0000c2ec, 0x00000000},
+        {0x0000c2f0, 0x00000000},
+        {0x0000c2f4, 0x00000000},
+        {0x0000c2f8, 0x00000000},
+        {0x0000c408, 0x0e79e5c0},
+        {0x0000c40c, 0x00820820},
+        {0x0000c420, 0x00000000},
+};
+static const u32 ar955x_1p0_common_wo_xlna_rx_gain_table[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a000, 0x00010000},
+        {0x0000a004, 0x00030002},
+        {0x0000a008, 0x00050004},
+        {0x0000a00c, 0x00810080},
+        {0x0000a010, 0x00830082},
+        {0x0000a014, 0x01810180},
+        {0x0000a018, 0x01830182},
+        {0x0000a01c, 0x01850184},
+        {0x0000a020, 0x01890188},
+        {0x0000a024, 0x018b018a},
+        {0x0000a028, 0x018d018c},
+        {0x0000a02c, 0x03820190},
+        {0x0000a030, 0x03840383},
+        {0x0000a034, 0x03880385},
+        {0x0000a038, 0x038a0389},
+        {0x0000a03c, 0x038c038b},
+        {0x0000a040, 0x0390038d},
+        {0x0000a044, 0x03920391},
+        {0x0000a048, 0x03940393},
+        {0x0000a04c, 0x03960395},
+        {0x0000a050, 0x00000000},
+        {0x0000a054, 0x00000000},
+        {0x0000a058, 0x00000000},
+        {0x0000a05c, 0x00000000},
+        {0x0000a060, 0x00000000},
+        {0x0000a064, 0x00000000},
+        {0x0000a068, 0x00000000},
+        {0x0000a06c, 0x00000000},
+        {0x0000a070, 0x00000000},
+        {0x0000a074, 0x00000000},
+        {0x0000a078, 0x00000000},
+        {0x0000a07c, 0x00000000},
+        {0x0000a080, 0x29292929},
+        {0x0000a084, 0x29292929},
+        {0x0000a088, 0x29292929},
+        {0x0000a08c, 0x29292929},
+        {0x0000a090, 0x22292929},
+        {0x0000a094, 0x1d1d2222},
+        {0x0000a098, 0x0c111117},
+        {0x0000a09c, 0x00030303},
+        {0x0000a0a0, 0x00000000},
+        {0x0000a0a4, 0x00000000},
+        {0x0000a0a8, 0x00000000},
+        {0x0000a0ac, 0x00000000},
+        {0x0000a0b0, 0x00000000},
+        {0x0000a0b4, 0x00000000},
+        {0x0000a0b8, 0x00000000},
+        {0x0000a0bc, 0x00000000},
+        {0x0000a0c0, 0x001f0000},
+        {0x0000a0c4, 0x01000101},
+        {0x0000a0c8, 0x011e011f},
+        {0x0000a0cc, 0x011c011d},
+        {0x0000a0d0, 0x02030204},
+        {0x0000a0d4, 0x02010202},
+        {0x0000a0d8, 0x021f0200},
+        {0x0000a0dc, 0x0302021e},
+        {0x0000a0e0, 0x03000301},
+        {0x0000a0e4, 0x031e031f},
+        {0x0000a0e8, 0x0402031d},
+        {0x0000a0ec, 0x04000401},
+        {0x0000a0f0, 0x041e041f},
+        {0x0000a0f4, 0x0502041d},
+        {0x0000a0f8, 0x05000501},
+        {0x0000a0fc, 0x051e051f},
+        {0x0000a100, 0x06010602},
+        {0x0000a104, 0x061f0600},
+        {0x0000a108, 0x061d061e},
+        {0x0000a10c, 0x07020703},
+        {0x0000a110, 0x07000701},
+        {0x0000a114, 0x00000000},
+        {0x0000a118, 0x00000000},
+        {0x0000a11c, 0x00000000},
+        {0x0000a120, 0x00000000},
+        {0x0000a124, 0x00000000},
+        {0x0000a128, 0x00000000},
+        {0x0000a12c, 0x00000000},
+        {0x0000a130, 0x00000000},
+        {0x0000a134, 0x00000000},
+        {0x0000a138, 0x00000000},
+        {0x0000a13c, 0x00000000},
+        {0x0000a140, 0x001f0000},
+        {0x0000a144, 0x01000101},
+        {0x0000a148, 0x011e011f},
+        {0x0000a14c, 0x011c011d},
+        {0x0000a150, 0x02030204},
+        {0x0000a154, 0x02010202},
+        {0x0000a158, 0x021f0200},
+        {0x0000a15c, 0x0302021e},
+        {0x0000a160, 0x03000301},
+        {0x0000a164, 0x031e031f},
+        {0x0000a168, 0x0402031d},
+        {0x0000a16c, 0x04000401},
+        {0x0000a170, 0x041e041f},
+        {0x0000a174, 0x0502041d},
+        {0x0000a178, 0x05000501},
+        {0x0000a17c, 0x051e051f},
+        {0x0000a180, 0x06010602},
+        {0x0000a184, 0x061f0600},
+        {0x0000a188, 0x061d061e},
+        {0x0000a18c, 0x07020703},
+        {0x0000a190, 0x07000701},
+        {0x0000a194, 0x00000000},
+        {0x0000a198, 0x00000000},
+        {0x0000a19c, 0x00000000},
+        {0x0000a1a0, 0x00000000},
+        {0x0000a1a4, 0x00000000},
+        {0x0000a1a8, 0x00000000},
+        {0x0000a1ac, 0x00000000},
+        {0x0000a1b0, 0x00000000},
+        {0x0000a1b4, 0x00000000},
+        {0x0000a1b8, 0x00000000},
+        {0x0000a1bc, 0x00000000},
+        {0x0000a1c0, 0x00000000},
+        {0x0000a1c4, 0x00000000},
+        {0x0000a1c8, 0x00000000},
+        {0x0000a1cc, 0x00000000},
+        {0x0000a1d0, 0x00000000},
+        {0x0000a1d4, 0x00000000},
+        {0x0000a1d8, 0x00000000},
+        {0x0000a1dc, 0x00000000},
+        {0x0000a1e0, 0x00000000},
+        {0x0000a1e4, 0x00000000},
+        {0x0000a1e8, 0x00000000},
+        {0x0000a1ec, 0x00000000},
+        {0x0000a1f0, 0x00000396},
+        {0x0000a1f4, 0x00000396},
+        {0x0000a1f8, 0x00000396},
+        {0x0000a1fc, 0x00000196},
+        {0x0000b000, 0x00010000},
+        {0x0000b004, 0x00030002},
+        {0x0000b008, 0x00050004},
+        {0x0000b00c, 0x00810080},
+        {0x0000b010, 0x00830082},
+        {0x0000b014, 0x01810180},
+        {0x0000b018, 0x01830182},
+        {0x0000b01c, 0x01850184},
+        {0x0000b020, 0x02810280},
+        {0x0000b024, 0x02830282},
+        {0x0000b028, 0x02850284},
+        {0x0000b02c, 0x02890288},
+        {0x0000b030, 0x028b028a},
+        {0x0000b034, 0x0388028c},
+        {0x0000b038, 0x038a0389},
+        {0x0000b03c, 0x038c038b},
+        {0x0000b040, 0x0390038d},
+        {0x0000b044, 0x03920391},
+        {0x0000b048, 0x03940393},
+        {0x0000b04c, 0x03960395},
+        {0x0000b050, 0x00000000},
+        {0x0000b054, 0x00000000},
+        {0x0000b058, 0x00000000},
+        {0x0000b05c, 0x00000000},
+        {0x0000b060, 0x00000000},
+        {0x0000b064, 0x00000000},
+        {0x0000b068, 0x00000000},
+        {0x0000b06c, 0x00000000},
+        {0x0000b070, 0x00000000},
+        {0x0000b074, 0x00000000},
+        {0x0000b078, 0x00000000},
+        {0x0000b07c, 0x00000000},
+        {0x0000b080, 0x32323232},
+        {0x0000b084, 0x2f2f3232},
+        {0x0000b088, 0x23282a2d},
+        {0x0000b08c, 0x1c1e2123},
+        {0x0000b090, 0x14171919},
+        {0x0000b094, 0x0e0e1214},
+        {0x0000b098, 0x03050707},
+        {0x0000b09c, 0x00030303},
+        {0x0000b0a0, 0x00000000},
+        {0x0000b0a4, 0x00000000},
+        {0x0000b0a8, 0x00000000},
+        {0x0000b0ac, 0x00000000},
+        {0x0000b0b0, 0x00000000},
+        {0x0000b0b4, 0x00000000},
+        {0x0000b0b8, 0x00000000},
+        {0x0000b0bc, 0x00000000},
+        {0x0000b0c0, 0x003f0020},
+        {0x0000b0c4, 0x00400041},
+        {0x0000b0c8, 0x0140005f},
+        {0x0000b0cc, 0x0160015f},
+        {0x0000b0d0, 0x017e017f},
+        {0x0000b0d4, 0x02410242},
+        {0x0000b0d8, 0x025f0240},
+        {0x0000b0dc, 0x027f0260},
+        {0x0000b0e0, 0x0341027e},
+        {0x0000b0e4, 0x035f0340},
+        {0x0000b0e8, 0x037f0360},
+        {0x0000b0ec, 0x04400441},
+        {0x0000b0f0, 0x0460045f},
+        {0x0000b0f4, 0x0541047f},
+        {0x0000b0f8, 0x055f0540},
+        {0x0000b0fc, 0x057f0560},
+        {0x0000b100, 0x06400641},
+        {0x0000b104, 0x0660065f},
+        {0x0000b108, 0x067e067f},
+        {0x0000b10c, 0x07410742},
+        {0x0000b110, 0x075f0740},
+        {0x0000b114, 0x077f0760},
+        {0x0000b118, 0x07800781},
+        {0x0000b11c, 0x07a0079f},
+        {0x0000b120, 0x07c107bf},
+        {0x0000b124, 0x000007c0},
+        {0x0000b128, 0x00000000},
+        {0x0000b12c, 0x00000000},
+        {0x0000b130, 0x00000000},
+        {0x0000b134, 0x00000000},
+        {0x0000b138, 0x00000000},
+        {0x0000b13c, 0x00000000},
+        {0x0000b140, 0x003f0020},
+        {0x0000b144, 0x00400041},
+        {0x0000b148, 0x0140005f},
+        {0x0000b14c, 0x0160015f},
+        {0x0000b150, 0x017e017f},
+        {0x0000b154, 0x02410242},
+        {0x0000b158, 0x025f0240},
+        {0x0000b15c, 0x027f0260},
+        {0x0000b160, 0x0341027e},
+        {0x0000b164, 0x035f0340},
+        {0x0000b168, 0x037f0360},
+        {0x0000b16c, 0x04400441},
+        {0x0000b170, 0x0460045f},
+        {0x0000b174, 0x0541047f},
+        {0x0000b178, 0x055f0540},
+        {0x0000b17c, 0x057f0560},
+        {0x0000b180, 0x06400641},
+        {0x0000b184, 0x0660065f},
+        {0x0000b188, 0x067e067f},
+        {0x0000b18c, 0x07410742},
+        {0x0000b190, 0x075f0740},
+        {0x0000b194, 0x077f0760},
+        {0x0000b198, 0x07800781},
+        {0x0000b19c, 0x07a0079f},
+        {0x0000b1a0, 0x07c107bf},
+        {0x0000b1a4, 0x000007c0},
+        {0x0000b1a8, 0x00000000},
+        {0x0000b1ac, 0x00000000},
+        {0x0000b1b0, 0x00000000},
+        {0x0000b1b4, 0x00000000},
+        {0x0000b1b8, 0x00000000},
+        {0x0000b1bc, 0x00000000},
+        {0x0000b1c0, 0x00000000},
+        {0x0000b1c4, 0x00000000},
+        {0x0000b1c8, 0x00000000},
+        {0x0000b1cc, 0x00000000},
+        {0x0000b1d0, 0x00000000},
+        {0x0000b1d4, 0x00000000},
+        {0x0000b1d8, 0x00000000},
+        {0x0000b1dc, 0x00000000},
+        {0x0000b1e0, 0x00000000},
+        {0x0000b1e4, 0x00000000},
+        {0x0000b1e8, 0x00000000},
+        {0x0000b1ec, 0x00000000},
+        {0x0000b1f0, 0x00000396},
+        {0x0000b1f4, 0x00000396},
+        {0x0000b1f8, 0x00000396},
+        {0x0000b1fc, 0x00000196},
+};
+static const u32 ar955x_1p0_soc_preamble[][2] = {
+        /* Addr      allmodes  */
+        {0x00007000, 0x00000000},
+        {0x00007004, 0x00000000},
+        {0x00007008, 0x00000000},
+        {0x0000700c, 0x00000000},
+        {0x0000701c, 0x00000000},
+        {0x00007020, 0x00000000},
+        {0x00007024, 0x00000000},
+        {0x00007028, 0x00000000},
+        {0x0000702c, 0x00000000},
+        {0x00007030, 0x00000000},
+        {0x00007034, 0x00000002},
+        {0x00007038, 0x000004c2},
+        {0x00007048, 0x00000000},
+};
+static const u32 ar955x_1p0_common_wo_xlna_rx_gain_bounds[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
+        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
+};
+static const u32 ar955x_1p0_mac_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160},
+        {0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c},
+        {0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38},
+        {0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00},
+        {0x0000801c, 0x128d8027, 0x128d804f, 0x12e00057, 0x12e0002b},
+        {0x00008120, 0x08f04800, 0x08f04800, 0x08f04810, 0x08f04810},
+        {0x000081d0, 0x00003210, 0x00003210, 0x0000320a, 0x0000320a},
+        {0x00008318, 0x00003e80, 0x00007d00, 0x00006880, 0x00003440},
+};
+static const u32 ar955x_1p0_common_rx_gain_bounds[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
+        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302018, 0x50302018},
+};
+static const u32 ar955x_1p0_modes_no_xpa_tx_gain_table[][9] = {
+        /* Addr      5G_HT20_L   5G_HT40_L   5G_HT20_M   5G_HT40_M   5G_HT20_H   5G_HT40_H   2G_HT40     2G_HT20  */
+        {0x0000a2dc, 0x01feee00, 0x01feee00, 0x01feee00, 0x01feee00, 0x01feee00, 0x01feee00, 0xfffe5aaa, 0xfffe5aaa},
+        {0x0000a2e0, 0x0000f000, 0x0000f000, 0x0000f000, 0x0000f000, 0x0000f000, 0x0000f000, 0xfffe9ccc, 0xfffe9ccc},
+        {0x0000a2e4, 0x01ff0000, 0x01ff0000, 0x01ff0000, 0x01ff0000, 0x01ff0000, 0x01ff0000, 0xffffe0f0, 0xffffe0f0},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0xffffef00, 0xffffef00},
+        {0x0000a410, 0x000050d8, 0x000050d8, 0x000050d8, 0x000050d8, 0x000050d8, 0x000050d8, 0x000050d7, 0x000050d7},
+        {0x0000a500, 0x00002220, 0x00002220, 0x00002220, 0x00002220, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
+        {0x0000a504, 0x04002222, 0x04002222, 0x04002222, 0x04002222, 0x04002222, 0x04002222, 0x04000002, 0x04000002},
+        {0x0000a508, 0x09002421, 0x09002421, 0x09002421, 0x09002421, 0x09002421, 0x09002421, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x0d002621, 0x0d002621, 0x0d002621, 0x0d002621, 0x0d002621, 0x0d002621, 0x0b000006, 0x0b000006},
+        {0x0000a510, 0x13004620, 0x13004620, 0x13004620, 0x13004620, 0x13004620, 0x13004620, 0x0f00000a, 0x0f00000a},
+        {0x0000a514, 0x19004a20, 0x19004a20, 0x19004a20, 0x19004a20, 0x19004a20, 0x19004a20, 0x1300000c, 0x1300000c},
+        {0x0000a518, 0x1d004e20, 0x1d004e20, 0x1d004e20, 0x1d004e20, 0x1d004e20, 0x1d004e20, 0x1700000e, 0x1700000e},
+        {0x0000a51c, 0x21005420, 0x21005420, 0x21005420, 0x21005420, 0x21005420, 0x21005420, 0x1b000012, 0x1b000012},
+        {0x0000a520, 0x26005e20, 0x26005e20, 0x26005e20, 0x26005e20, 0x26005e20, 0x26005e20, 0x1f00004a, 0x1f00004a},
+        {0x0000a524, 0x2b005e40, 0x2b005e40, 0x2b005e40, 0x2b005e40, 0x2b005e40, 0x2b005e40, 0x23000244, 0x23000244},
+        {0x0000a528, 0x2f005e42, 0x2f005e42, 0x2f005e42, 0x2f005e42, 0x2f005e42, 0x2f005e42, 0x2700022b, 0x2700022b},
+        {0x0000a52c, 0x33005e44, 0x33005e44, 0x33005e44, 0x33005e44, 0x33005e44, 0x33005e44, 0x2b000625, 0x2b000625},
+        {0x0000a530, 0x38005e65, 0x38005e65, 0x38005e65, 0x38005e65, 0x38005e65, 0x38005e65, 0x2f001006, 0x2f001006},
+        {0x0000a534, 0x3c005e69, 0x3c005e69, 0x3c005e69, 0x3c005e69, 0x3c005e69, 0x3c005e69, 0x330008a0, 0x330008a0},
+        {0x0000a538, 0x40005e6b, 0x40005e6b, 0x40005e6b, 0x40005e6b, 0x40005e6b, 0x40005e6b, 0x37000a2a, 0x37000a2a},
+        {0x0000a53c, 0x44005e6d, 0x44005e6d, 0x44005e6d, 0x44005e6d, 0x44005e6d, 0x44005e6d, 0x3b001c23, 0x3b001c23},
+        {0x0000a540, 0x49005e72, 0x49005e72, 0x49005e72, 0x49005e72, 0x49005e72, 0x49005e72, 0x3f0014a0, 0x3f0014a0},
+        {0x0000a544, 0x4e005eb2, 0x4e005eb2, 0x4e005eb2, 0x4e005eb2, 0x4e005eb2, 0x4e005eb2, 0x43001882, 0x43001882},
+        {0x0000a548, 0x53005f12, 0x53005f12, 0x53005f12, 0x53005f12, 0x53005f12, 0x53005f12, 0x47001ca2, 0x47001ca2},
+        {0x0000a54c, 0x59025eb2, 0x59025eb2, 0x59025eb2, 0x59025eb2, 0x59025eb2, 0x59025eb2, 0x4b001ec3, 0x4b001ec3},
+        {0x0000a550, 0x5e025f12, 0x5e025f12, 0x5e025f12, 0x5e025f12, 0x5e025f12, 0x5e025f12, 0x4f00148c, 0x4f00148c},
+        {0x0000a554, 0x61027f12, 0x61027f12, 0x61027f12, 0x61027f12, 0x61027f12, 0x61027f12, 0x53001c6e, 0x53001c6e},
+        {0x0000a558, 0x6702bf12, 0x6702bf12, 0x6702bf12, 0x6702bf12, 0x6702bf12, 0x6702bf12, 0x57001c92, 0x57001c92},
+        {0x0000a55c, 0x6b02bf14, 0x6b02bf14, 0x6b02bf14, 0x6b02bf14, 0x6b02bf14, 0x6b02bf14, 0x5c001af6, 0x5c001af6},
+        {0x0000a560, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x5c001af6, 0x5c001af6},
+        {0x0000a564, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x5c001af6, 0x5c001af6},
+        {0x0000a568, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x5c001af6, 0x5c001af6},
+        {0x0000a56c, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x5c001af6, 0x5c001af6},
+        {0x0000a570, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x5c001af6, 0x5c001af6},
+        {0x0000a574, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x5c001af6, 0x5c001af6},
+        {0x0000a578, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x5c001af6, 0x5c001af6},
+        {0x0000a57c, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x6f02bf16, 0x5c001af6, 0x5c001af6},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00804000, 0x00804000, 0x00804000, 0x00804000, 0x00804000, 0x00804000, 0x04005001, 0x04005001},
+        {0x0000a614, 0x00804201, 0x00804201, 0x00804201, 0x00804201, 0x00804201, 0x00804201, 0x03808e02, 0x03808e02},
+        {0x0000a618, 0x0280c802, 0x0280c802, 0x0280c802, 0x0280c802, 0x0280c802, 0x0280c802, 0x0300c000, 0x0300c000},
+        {0x0000a61c, 0x0280ca03, 0x0280ca03, 0x0280ca03, 0x0280ca03, 0x0280ca03, 0x0280ca03, 0x03808e02, 0x03808e02},
+        {0x0000a620, 0x04c15104, 0x04c15104, 0x04c15104, 0x04c15104, 0x04c15104, 0x04c15104, 0x03410c03, 0x03410c03},
+        {0x0000a624, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x04014c03, 0x04014c03},
+        {0x0000a628, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x05818d04, 0x05818d04},
+        {0x0000a62c, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x0801cd04, 0x0801cd04},
+        {0x0000a630, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x0801e007, 0x0801e007},
+        {0x0000a634, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x0801e007, 0x0801e007},
+        {0x0000a638, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x0801e007, 0x0801e007},
+        {0x0000a63c, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x04c15305, 0x0801e007, 0x0801e007},
+        {0x0000b2dc, 0x01feee00, 0x01feee00, 0x01feee00, 0x01feee00, 0x01feee00, 0x01feee00, 0xfffe5aaa, 0xfffe5aaa},
+        {0x0000b2e0, 0x0000f000, 0x0000f000, 0x0000f000, 0x0000f000, 0x0000f000, 0x0000f000, 0xfffe9ccc, 0xfffe9ccc},
+        {0x0000b2e4, 0x01ff0000, 0x01ff0000, 0x01ff0000, 0x01ff0000, 0x01ff0000, 0x01ff0000, 0xffffe0f0, 0xffffe0f0},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0xffffef00, 0xffffef00},
+        {0x0000c2dc, 0x01feee00, 0x01feee00, 0x01feee00, 0x01feee00, 0x01feee00, 0x01feee00, 0xfffe5aaa, 0xfffe5aaa},
+        {0x0000c2e0, 0x0000f000, 0x0000f000, 0x0000f000, 0x0000f000, 0x0000f000, 0x0000f000, 0xfffe9ccc, 0xfffe9ccc},
+        {0x0000c2e4, 0x01ff0000, 0x01ff0000, 0x01ff0000, 0x01ff0000, 0x01ff0000, 0x01ff0000, 0xffffe0f0, 0xffffe0f0},
+        {0x0000c2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0xffffef00, 0xffffef00},
+        {0x00016044, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x054922d4, 0x054922d4},
+        {0x00016048, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401},
+        {0x00016444, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x054922d4, 0x054922d4},
+        {0x00016448, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401},
+        {0x00016844, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x054922d4, 0x054922d4},
+        {0x00016848, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401},
+};
+static const u32 ar955x_1p0_soc_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00007010, 0x00000023, 0x00000023, 0x00000023, 0x00000023},
+};
+static const u32 ar955x_1p0_modes_fast_clock[][3] = {
+        /* Addr      5G_HT20     5G_HT40   */
+        {0x00001030, 0x00000268, 0x000004d0},
+        {0x00001070, 0x0000018c, 0x00000318},
+        {0x000010b0, 0x00000fd0, 0x00001fa0},
+        {0x00008014, 0x044c044c, 0x08980898},
+        {0x0000801c, 0x148ec02b, 0x148ec057},
+        {0x00008318, 0x000044c0, 0x00008980},
+        {0x00009e00, 0x0372131c, 0x0372131c},
+        {0x0000a230, 0x0000000b, 0x00000016},
+        {0x0000a254, 0x00000898, 0x00001130},
+};
+#endif /* INITVALS_955X_1P0_H */
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index fe39eb4c42a1..79840d6deef2 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -481,6 +481,7 @@ void ath9k_btcoex_timer_resume(struct ath_softc *sc);
 void ath9k_btcoex_timer_pause(struct ath_softc *sc);
 void ath9k_btcoex_handle_interrupt(struct ath_softc *sc, u32 status);
 u16 ath9k_btcoex_aggr_limit(struct ath_softc *sc, u32 max_4ms_framelen);
+void ath9k_btcoex_stop_gen_timer(struct ath_softc *sc);
 #else
 static inline int ath9k_init_btcoex(struct ath_softc *sc)
 {
@@ -504,6 +505,9 @@ static inline u16 ath9k_btcoex_aggr_limit(struct ath_softc *sc,
 {
        return 0;
 }
+static inline void ath9k_btcoex_stop_gen_timer(struct ath_softc *sc)
+{
+}
 #endif /* CONFIG_ATH9K_BTCOEX_SUPPORT */
 /********************/
diff --git a/drivers/net/wireless/ath/ath9k/gpio.c b/drivers/net/wireless/ath/ath9k/gpio.c
index 9ae6a4d97691..bacdb8fb4ef4 100644
--- a/drivers/net/wireless/ath/ath9k/gpio.c
+++ b/drivers/net/wireless/ath/ath9k/gpio.c
@@ -194,6 +194,14 @@ static void ath_btcoex_period_timer(unsigned long data)
        struct ath_mci_profile *mci = &btcoex->mci;
        u32 timer_period;
        bool is_btscan;
+        unsigned long flags;
+        spin_lock_irqsave(&sc->sc_pm_lock, flags);
+        if (sc->sc_ah->power_mode == ATH9K_PM_NETWORK_SLEEP) {
+                spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
+                goto skip_hw_wakeup;
+        }
+        spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
        ath9k_ps_wakeup(sc);
        if (!(ah->caps.hw_caps & ATH9K_HW_CAP_MCI))
@@ -232,6 +240,7 @@ static void ath_btcoex_period_timer(unsigned long data)
        }
        ath9k_ps_restore(sc);
+skip_hw_wakeup:
        timer_period = btcoex->btcoex_period;
        mod_timer(&btcoex->period_timer, jiffies + msecs_to_jiffies(timer_period));
 }
@@ -305,7 +314,8 @@ void ath9k_btcoex_timer_resume(struct ath_softc *sc)
        btcoex->bt_priority_cnt = 0;
        btcoex->bt_priority_time = jiffies;
-        btcoex->op_flags &= ~(BT_OP_PRIORITY_DETECTED | BT_OP_SCAN);
+        clear_bit(BT_OP_PRIORITY_DETECTED, &btcoex->op_flags);
+        clear_bit(BT_OP_SCAN, &btcoex->op_flags);
        mod_timer(&btcoex->period_timer, jiffies);
 }
@@ -327,6 +337,13 @@ void ath9k_btcoex_timer_pause(struct ath_softc *sc)
        btcoex->hw_timer_enabled = false;
 }
+void ath9k_btcoex_stop_gen_timer(struct ath_softc *sc)
+{
+        struct ath_btcoex *btcoex = &sc->btcoex;
+        ath9k_gen_timer_stop(sc->sc_ah, btcoex->no_stomp_timer);
+}
 u16 ath9k_btcoex_aggr_limit(struct ath_softc *sc, u32 max_4ms_framelen)
 {
        struct ath_btcoex *btcoex = &sc->btcoex;
@@ -376,9 +393,9 @@ void ath9k_stop_btcoex(struct ath_softc *sc)
        if (ah->btcoex_hw.enabled &&
            ath9k_hw_get_btcoex_scheme(ah) != ATH_BTCOEX_CFG_NONE) {
-                ath9k_hw_btcoex_disable(ah);
                if (ath9k_hw_get_btcoex_scheme(ah) == ATH_BTCOEX_CFG_3WIRE)
                        ath9k_btcoex_timer_pause(sc);
+                ath9k_hw_btcoex_disable(ah);
                if (AR_SREV_9462(ah))
                        ath_mci_flush_profile(&sc->btcoex.mci);
        }
@@ -386,11 +403,13 @@ void ath9k_stop_btcoex(struct ath_softc *sc)
 void ath9k_deinit_btcoex(struct ath_softc *sc)
 {
+        struct ath_hw *ah = sc->sc_ah;
        if ((sc->btcoex.no_stomp_timer) &&
            ath9k_hw_get_btcoex_scheme(sc->sc_ah) == ATH_BTCOEX_CFG_3WIRE)
                ath_gen_timer_free(sc->sc_ah, sc->btcoex.no_stomp_timer);
-        if (AR_SREV_9462(sc->sc_ah))
+        if (ath9k_hw_mci_is_enabled(ah))
                ath_mci_cleanup(sc);
 }
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index ebfb2a3c645c..c1659d079513 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -342,6 +342,9 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
                val = REG_READ(ah, AR_SREV);
                ah->hw_version.macRev = MS(val, AR_SREV_REVISION2);
                return;
+        case AR9300_DEVID_QCA955X:
+                ah->hw_version.macVersion = AR_SREV_VERSION_9550;
+                return;
        }
        val = REG_READ(ah, AR_SREV) & AR_SREV_ID;
@@ -646,6 +649,7 @@ static int __ath9k_hw_init(struct ath_hw *ah)
        case AR_SREV_VERSION_9485:
        case AR_SREV_VERSION_9340:
        case AR_SREV_VERSION_9462:
+        case AR_SREV_VERSION_9550:
                break;
        default:
                ath_err(common,
@@ -655,7 +659,7 @@ static int __ath9k_hw_init(struct ath_hw *ah)
        }
        if (AR_SREV_9271(ah) || AR_SREV_9100(ah) || AR_SREV_9340(ah) ||
-            AR_SREV_9330(ah))
+            AR_SREV_9330(ah) || AR_SREV_9550(ah))
                ah->is_pciexpress = false;
        ah->hw_version.phyRev = REG_READ(ah, AR_PHY_CHIP_ID);
@@ -727,6 +731,7 @@ int ath9k_hw_init(struct ath_hw *ah)
        case AR9300_DEVID_AR9485_PCIE:
        case AR9300_DEVID_AR9330:
        case AR9300_DEVID_AR9340:
+        case AR9300_DEVID_QCA955X:
        case AR9300_DEVID_AR9580:
        case AR9300_DEVID_AR9462:
                break;
@@ -865,7 +870,7 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                /* program BB PLL phase_shift */
                REG_RMW_FIELD(ah, AR_CH0_BB_DPLL3,
                              AR_CH0_BB_DPLL3_PHASE_SHIFT, 0x1);
-        } else if (AR_SREV_9340(ah)) {
+        } else if (AR_SREV_9340(ah) || AR_SREV_9550(ah)) {
                u32 regval, pll2_divint, pll2_divfrac, refdiv;
                REG_WRITE(ah, AR_RTC_PLL_CONTROL, 0x1142c);
@@ -879,9 +884,15 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                        pll2_divfrac = 0x1eb85;
                        refdiv = 3;
                } else {
-                        pll2_divint = 88;
+                        if (AR_SREV_9340(ah)) {
-                        pll2_divfrac = 0;
+                                pll2_divint = 88;
-                        refdiv = 5;
+                                pll2_divfrac = 0;
+                                refdiv = 5;
+                        } else {
+                                pll2_divint = 0x11;
+                                pll2_divfrac = 0x26666;
+                                refdiv = 1;
+                        }
                }
                regval = REG_READ(ah, AR_PHY_PLL_MODE);
@@ -894,8 +905,12 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                udelay(100);
                regval = REG_READ(ah, AR_PHY_PLL_MODE);
-                regval = (regval & 0x80071fff) | (0x1 << 30) | (0x1 << 13) |
+                if (AR_SREV_9340(ah))
-                         (0x4 << 26) | (0x18 << 19);
+                        regval = (regval & 0x80071fff) | (0x1 << 30) |
+                                 (0x1 << 13) | (0x4 << 26) | (0x18 << 19);
+                else
+                        regval = (regval & 0x80071fff) | (0x3 << 30) |
+                                 (0x1 << 13) | (0x4 << 26) | (0x60 << 19);
                REG_WRITE(ah, AR_PHY_PLL_MODE, regval);
                REG_WRITE(ah, AR_PHY_PLL_MODE,
                          REG_READ(ah, AR_PHY_PLL_MODE) & 0xfffeffff);
@@ -906,7 +921,8 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
        REG_WRITE(ah, AR_RTC_PLL_CONTROL, pll);
-        if (AR_SREV_9485(ah) || AR_SREV_9340(ah) || AR_SREV_9330(ah))
+        if (AR_SREV_9485(ah) || AR_SREV_9340(ah) || AR_SREV_9330(ah) ||
+            AR_SREV_9550(ah))
                udelay(1000);
        /* Switch the core clock for ar9271 to 117Mhz */
@@ -919,7 +935,7 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
        REG_WRITE(ah, AR_RTC_SLEEP_CLK, AR_RTC_FORCE_DERIVED_CLK);
-        if (AR_SREV_9340(ah)) {
+        if (AR_SREV_9340(ah) || AR_SREV_9550(ah)) {
                if (ah->is_clk_25mhz) {
                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
@@ -943,7 +959,7 @@ static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
                AR_IMR_RXORN |
                AR_IMR_BCNMISC;
-        if (AR_SREV_9340(ah))
+        if (AR_SREV_9340(ah) || AR_SREV_9550(ah))
                sync_default &= ~AR_INTR_SYNC_HOST1_FATAL;
        if (AR_SREV_9300_20_OR_LATER(ah)) {
@@ -1949,9 +1965,6 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
        if (!ath9k_hw_init_cal(ah, chan))
                return -EIO;
-        ath9k_hw_loadnf(ah, chan);
-        ath9k_hw_start_nfcal(ah, true);
        if (ath9k_hw_mci_is_enabled(ah) && ar9003_mci_end_reset(ah, chan, caldata))
                return -EIO;
@@ -1987,7 +2000,8 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                                REG_WRITE(ah, AR_CFG, AR_CFG_SWTD | AR_CFG_SWRD);
                }
 #ifdef __BIG_ENDIAN
-                else if (AR_SREV_9330(ah) || AR_SREV_9340(ah))
+                else if (AR_SREV_9330(ah) || AR_SREV_9340(ah) ||
+                         AR_SREV_9550(ah))
                        REG_RMW(ah, AR_CFG, AR_CFG_SWRB | AR_CFG_SWTB, 0);
                else
                        REG_WRITE(ah, AR_CFG, AR_CFG_SWTD | AR_CFG_SWRD);
@@ -2000,6 +2014,9 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
        if (ath9k_hw_mci_is_enabled(ah))
                ar9003_mci_check_bt(ah);
+        ath9k_hw_loadnf(ah, chan);
+        ath9k_hw_start_nfcal(ah, true);
        if (AR_SREV_9300_20_OR_LATER(ah)) {
                ar9003_hw_bb_watchdog_config(ah);
@@ -3137,6 +3154,7 @@ static struct {
        { AR_SREV_VERSION_9340,         "9340" },
        { AR_SREV_VERSION_9485,         "9485" },
        { AR_SREV_VERSION_9462,         "9462" },
+        { AR_SREV_VERSION_9550,         "9550" },
 };
 /* For devices with external radios */
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 94096607cbdd..26da1732978d 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -48,6 +48,7 @@
 #define AR9300_DEVID_AR9580     0x0033
 #define AR9300_DEVID_AR9462     0x0034
 #define AR9300_DEVID_AR9330     0x0035
+#define AR9300_DEVID_QCA955X    0x0038
 #define AR5416_AR9100_DEVID     0x000b
@@ -818,6 +819,7 @@ struct ath_hw {
        struct ar5416IniArray iniModesFastClock;
        struct ar5416IniArray iniAdditional;
        struct ar5416IniArray iniModesRxGain;
+        struct ar5416IniArray ini_modes_rx_gain_bounds;
        struct ar5416IniArray iniModesTxGain;
        struct ar5416IniArray iniCckfirNormal;
        struct ar5416IniArray iniCckfirJapan2484;
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 04ef775ccee1..7990cd55599c 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -810,7 +810,7 @@ void ath9k_hw_enable_interrupts(struct ath_hw *ah)
                return;
        }
-        if (AR_SREV_9340(ah))
+        if (AR_SREV_9340(ah) || AR_SREV_9550(ah))
                sync_default &= ~AR_INTR_SYNC_HOST1_FATAL;
        async_mask = AR_INTR_MAC_IRQ;
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index 21c955609e6c..0eba36dca6f8 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -646,6 +646,7 @@ enum ath9k_rx_filter {
        ATH9K_RX_FILTER_PHYRADAR = 0x00002000,
        ATH9K_RX_FILTER_MCAST_BCAST_ALL = 0x00008000,
        ATH9K_RX_FILTER_CONTROL_WRAPPER = 0x00080000,
+        ATH9K_RX_FILTER_4ADDRESS = 0x00100000,
 };
 #define ATH9K_RATESERIES_RTS_CTS  0x0001
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index e4e73f061a22..248e5b24acfa 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -130,6 +130,8 @@ void ath9k_ps_restore(struct ath_softc *sc)
                                     PS_WAIT_FOR_PSPOLL_DATA |
                                     PS_WAIT_FOR_TX_ACK))) {
                mode = ATH9K_PM_NETWORK_SLEEP;
+                if (ath9k_hw_btcoex_is_enabled(sc->sc_ah))
+                        ath9k_btcoex_stop_gen_timer(sc);
        } else {
                goto unlock;
        }
@@ -169,7 +171,8 @@ static void ath_restart_work(struct ath_softc *sc)
        ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
-        if (AR_SREV_9485(sc->sc_ah) || AR_SREV_9340(sc->sc_ah))
+        if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9485(sc->sc_ah) ||
+            AR_SREV_9550(sc->sc_ah))
                ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work,
                                     msecs_to_jiffies(ATH_PLL_WORK_INTERVAL));
@@ -666,8 +669,6 @@ static int ath9k_start(struct ieee80211_hw *hw)
        spin_unlock_bh(&sc->sc_pcu_lock);
-        ath9k_start_btcoex(sc);
        if (ah->caps.pcie_lcr_extsync_en && common->bus_ops->extn_synch_en)
                common->bus_ops->extn_synch_en(common);
@@ -774,8 +775,6 @@ static void ath9k_stop(struct ieee80211_hw *hw)
        /* Ensure HW is awake when we try to shut it down. */
        ath9k_ps_wakeup(sc);
-        ath9k_stop_btcoex(sc);
        spin_lock_bh(&sc->sc_pcu_lock);
        /* prevent tasklets to enable interrupts once we disable them */
@@ -1139,14 +1138,17 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
        if (changed & IEEE80211_CONF_CHANGE_IDLE) {
                sc->ps_idle = !!(conf->flags & IEEE80211_CONF_IDLE);
-                if (sc->ps_idle)
+                if (sc->ps_idle) {
                        ath_cancel_work(sc);
-                else
+                        ath9k_stop_btcoex(sc);
+                } else {
+                        ath9k_start_btcoex(sc);
                        /*
                         * The chip needs a reset to properly wake up from
                         * full sleep
                         */
                        reset_channel = ah->chip_fullsleep;
+                }
        }
        /*
diff --git a/drivers/net/wireless/ath/ath9k/mci.c b/drivers/net/wireless/ath/ath9k/mci.c
index 64cc782587d8..87acff7fdaae 100644
--- a/drivers/net/wireless/ath/ath9k/mci.c
+++ b/drivers/net/wireless/ath/ath9k/mci.c
@@ -174,8 +174,8 @@ skip_tuning:
                        btcoex->btcoex_period >>= 1;
        }
-        ath9k_hw_btcoex_disable(sc->sc_ah);
        ath9k_btcoex_timer_pause(sc);
+        ath9k_hw_btcoex_disable(sc->sc_ah);
        if (IS_CHAN_5GHZ(sc->sc_ah->curchan))
                return;
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 6a7dd26f2a13..11f3703a420a 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -430,6 +430,9 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
                rfilt |= ATH9K_RX_FILTER_MCAST_BCAST_ALL;
        }
+        if (AR_SREV_9550(sc->sc_ah))
+                rfilt |= ATH9K_RX_FILTER_4ADDRESS;
        return rfilt;
 }
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index 5046b282a93c..6592c07ac646 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -798,6 +798,7 @@
 #define AR_SREV_REVISION_9580_10        4 /* AR9580 1.0 */
 #define AR_SREV_VERSION_9462            0x280
 #define AR_SREV_REVISION_9462_20        2
+#define AR_SREV_VERSION_9550            0x400
 #define AR_SREV_5416(_ah) \
        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_5416_PCI) || \
@@ -905,6 +906,9 @@
        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9462) && \
        ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9462_20))
+#define AR_SREV_9550(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9550))
 #define AR_SREV_9580(_ah) \
        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9580) && \
        ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9580_10))
@@ -1643,11 +1647,11 @@ enum {
 #define AR_TPC                 0x80e8
 #define AR_TPC_ACK             0x0000003f
-#define AR_TPC_ACK_S           0x00
+#define AR_TPC_ACK_S           0
 #define AR_TPC_CTS             0x00003f00
-#define AR_TPC_CTS_S           0x08
+#define AR_TPC_CTS_S           8
 #define AR_TPC_CHIRP           0x003f0000
-#define AR_TPC_CHIRP_S         0x16
+#define AR_TPC_CHIRP_S         16
 #define AR_QUIET1          0x80fc
 #define AR_QUIET1_NEXT_QUIET_S         0
@@ -2077,12 +2081,6 @@ enum {
                                         AR_MCI_INTERRUPT_RX_MSG_REMOTE_RESET| \
                                         AR_MCI_INTERRUPT_RX_MSG_SYS_WAKING  | \
                                         AR_MCI_INTERRUPT_RX_MSG_SYS_SLEEPING| \
-                                         AR_MCI_INTERRUPT_RX_MSG_SCHD_INFO   | \
-                                         AR_MCI_INTERRUPT_RX_MSG_LNA_CONTROL | \
-                                         AR_MCI_INTERRUPT_RX_MSG_LNA_INFO    | \
-                                         AR_MCI_INTERRUPT_RX_MSG_CONT_NACK   | \
-                                         AR_MCI_INTERRUPT_RX_MSG_CONT_INFO   | \
-                                         AR_MCI_INTERRUPT_RX_MSG_CONT_RST    | \
                                         AR_MCI_INTERRUPT_RX_MSG_REQ_WAKE)
 #define AR_MCI_CPU_INT                                  0x1840
diff --git a/drivers/net/wireless/ath/carl9170/carl9170.h b/drivers/net/wireless/ath/carl9170/carl9170.h
index 0cea20e3e250..376be11161c0 100644
--- a/drivers/net/wireless/ath/carl9170/carl9170.h
+++ b/drivers/net/wireless/ath/carl9170/carl9170.h
@@ -289,6 +289,7 @@ struct ar9170 {
                unsigned int mem_block_size;
                unsigned int rx_size;
                unsigned int tx_seq_table;
+                bool ba_filter;
        } fw;
        /* interface configuration combinations */
@@ -425,6 +426,10 @@ struct ar9170 {
        struct sk_buff *rx_failover;
        int rx_failover_missing;
+        /* FIFO for collecting outstanding BlockAckRequest */
+        struct list_head bar_list[__AR9170_NUM_TXQ];
+        spinlock_t bar_list_lock[__AR9170_NUM_TXQ];
 #ifdef CONFIG_CARL9170_WPC
        struct {
                bool pbc_state;
@@ -468,6 +473,12 @@ enum carl9170_ps_off_override_reasons {
        PS_OFF_BCN      = BIT(1),
 };
+struct carl9170_bar_list_entry {
+        struct list_head list;
+        struct rcu_head head;
+        struct sk_buff *skb;
+};
 struct carl9170_ba_stats {
        u8 ampdu_len;
        u8 ampdu_ack_len;
diff --git a/drivers/net/wireless/ath/carl9170/fw.c b/drivers/net/wireless/ath/carl9170/fw.c
index 5c73c03872f3..c5ca6f1f5836 100644
--- a/drivers/net/wireless/ath/carl9170/fw.c
+++ b/drivers/net/wireless/ath/carl9170/fw.c
@@ -307,6 +307,9 @@ static int carl9170_fw(struct ar9170 *ar, const __u8 *data, size_t len)
        if (SUPP(CARL9170FW_WOL))
                device_set_wakeup_enable(&ar->udev->dev, true);
+        if (SUPP(CARL9170FW_RX_BA_FILTER))
+                ar->fw.ba_filter = true;
        if_comb_types = BIT(NL80211_IFTYPE_STATION) |
                        BIT(NL80211_IFTYPE_P2P_CLIENT);
diff --git a/drivers/net/wireless/ath/carl9170/fwdesc.h b/drivers/net/wireless/ath/carl9170/fwdesc.h
index 6d9c0891ce7f..66848d47c88e 100644
--- a/drivers/net/wireless/ath/carl9170/fwdesc.h
+++ b/drivers/net/wireless/ath/carl9170/fwdesc.h
@@ -78,6 +78,9 @@ enum carl9170fw_feature_list {
        /* HW (ANI, CCA, MIB) tally counters */
        CARL9170FW_HW_COUNTERS,
+        /* Firmware will pass BA when BARs are queued */
+        CARL9170FW_RX_BA_FILTER,
        /* KEEP LAST */
        __CARL9170FW_FEATURE_NUM
 };
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 8d2523b3f722..858e58dfc4dc 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -949,6 +949,9 @@ static void carl9170_op_configure_filter(struct ieee80211_hw *hw,
        if (ar->fw.rx_filter && changed_flags & ar->rx_filter_caps) {
                u32 rx_filter = 0;
+                if (!ar->fw.ba_filter)
+                        rx_filter |= CARL9170_RX_FILTER_CTL_OTHER;
                if (!(*new_flags & (FIF_FCSFAIL | FIF_PLCPFAIL)))
                        rx_filter |= CARL9170_RX_FILTER_BAD;
@@ -1753,6 +1756,9 @@ void *carl9170_alloc(size_t priv_size)
        for (i = 0; i < ar->hw->queues; i++) {
                skb_queue_head_init(&ar->tx_status[i]);
                skb_queue_head_init(&ar->tx_pending[i]);
+                INIT_LIST_HEAD(&ar->bar_list[i]);
+                spin_lock_init(&ar->bar_list_lock[i]);
        }
        INIT_WORK(&ar->ps_work, carl9170_ps_work);
        INIT_WORK(&ar->ping_work, carl9170_ping_work);
diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
index 7a8e90eaad83..6f6a34155667 100644
--- a/drivers/net/wireless/ath/carl9170/rx.c
+++ b/drivers/net/wireless/ath/carl9170/rx.c
@@ -576,6 +576,53 @@ static void carl9170_ps_beacon(struct ar9170 *ar, void *data, unsigned int len)
        }
 }
+static void carl9170_ba_check(struct ar9170 *ar, void *data, unsigned int len)
+{
+        struct ieee80211_bar *bar = (void *) data;
+        struct carl9170_bar_list_entry *entry;
+        unsigned int queue;
+        if (likely(!ieee80211_is_back(bar->frame_control)))
+                return;
+        if (len <= sizeof(*bar) + FCS_LEN)
+                return;
+        queue = TID_TO_WME_AC(((le16_to_cpu(bar->control) &
+                IEEE80211_BAR_CTRL_TID_INFO_MASK) >>
+                IEEE80211_BAR_CTRL_TID_INFO_SHIFT) & 7);
+        rcu_read_lock();
+        list_for_each_entry_rcu(entry, &ar->bar_list[queue], list) {
+                struct sk_buff *entry_skb = entry->skb;
+                struct _carl9170_tx_superframe *super = (void *)entry_skb->data;
+                struct ieee80211_bar *entry_bar = (void *)super->frame_data;
+#define TID_CHECK(a, b) (                                               \
+        ((a) & cpu_to_le16(IEEE80211_BAR_CTRL_TID_INFO_MASK)) ==        \
+        ((b) & cpu_to_le16(IEEE80211_BAR_CTRL_TID_INFO_MASK)))          \
+                if (bar->start_seq_num == entry_bar->start_seq_num &&
+                    TID_CHECK(bar->control, entry_bar->control) &&
+                    compare_ether_addr(bar->ra, entry_bar->ta) == 0 &&
+                    compare_ether_addr(bar->ta, entry_bar->ra) == 0) {
+                        struct ieee80211_tx_info *tx_info;
+                        tx_info = IEEE80211_SKB_CB(entry_skb);
+                        tx_info->flags |= IEEE80211_TX_STAT_ACK;
+                        spin_lock_bh(&ar->bar_list_lock[queue]);
+                        list_del_rcu(&entry->list);
+                        spin_unlock_bh(&ar->bar_list_lock[queue]);
+                        kfree_rcu(entry, head);
+                        break;
+                }
+        }
+        rcu_read_unlock();
+#undef TID_CHECK
+}
 static bool carl9170_ampdu_check(struct ar9170 *ar, u8 *buf, u8 ms)
 {
        __le16 fc;
@@ -738,6 +785,8 @@ static void carl9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len)
        carl9170_ps_beacon(ar, buf, mpdu_len);
+        carl9170_ba_check(ar, buf, mpdu_len);
        skb = carl9170_rx_copy_data(buf, mpdu_len);
        if (!skb)
                goto drop;
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index aed305177af6..6a8681407a1d 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -277,11 +277,11 @@ static void carl9170_tx_release(struct kref *ref)
                return;
        BUILD_BUG_ON(
-            offsetof(struct ieee80211_tx_info, status.ampdu_ack_len) != 23);
+            offsetof(struct ieee80211_tx_info, status.ack_signal) != 20);
-        memset(&txinfo->status.ampdu_ack_len, 0,
+        memset(&txinfo->status.ack_signal, 0,
               sizeof(struct ieee80211_tx_info) -
-               offsetof(struct ieee80211_tx_info, status.ampdu_ack_len));
+               offsetof(struct ieee80211_tx_info, status.ack_signal));
        if (atomic_read(&ar->tx_total_queued))
                ar->tx_schedule = true;
@@ -436,6 +436,45 @@ out_rcu:
        rcu_read_unlock();
 }
+static void carl9170_tx_bar_status(struct ar9170 *ar, struct sk_buff *skb,
+        struct ieee80211_tx_info *tx_info)
+{
+        struct _carl9170_tx_superframe *super = (void *) skb->data;
+        struct ieee80211_bar *bar = (void *) super->frame_data;
+        /*
+         * Unlike all other frames, the status report for BARs does
+         * not directly come from the hardware as it is incapable of
+         * matching a BA to a previously send BAR.
+         * Instead the RX-path will scan for incoming BAs and set the
+         * IEEE80211_TX_STAT_ACK if it sees one that was likely
+         * caused by a BAR from us.
+         */
+        if (unlikely(ieee80211_is_back_req(bar->frame_control)) &&
+           !(tx_info->flags & IEEE80211_TX_STAT_ACK)) {
+                struct carl9170_bar_list_entry *entry;
+                int queue = skb_get_queue_mapping(skb);
+                rcu_read_lock();
+                list_for_each_entry_rcu(entry, &ar->bar_list[queue], list) {
+                        if (entry->skb == skb) {
+                                spin_lock_bh(&ar->bar_list_lock[queue]);
+                                list_del_rcu(&entry->list);
+                                spin_unlock_bh(&ar->bar_list_lock[queue]);
+                                kfree_rcu(entry, head);
+                                goto out;
+                        }
+                }
+                WARN(1, "bar not found in %d - ra:%pM ta:%pM c:%x ssn:%x\n",
+                       queue, bar->ra, bar->ta, bar->control,
+                        bar->start_seq_num);
+out:
+                rcu_read_unlock();
+        }
+}
 void carl9170_tx_status(struct ar9170 *ar, struct sk_buff *skb,
                        const bool success)
 {
@@ -445,6 +484,8 @@ void carl9170_tx_status(struct ar9170 *ar, struct sk_buff *skb,
        txinfo = IEEE80211_SKB_CB(skb);
+        carl9170_tx_bar_status(ar, skb, txinfo);
        if (success)
                txinfo->flags |= IEEE80211_TX_STAT_ACK;
        else
@@ -1265,6 +1306,26 @@ out_rcu:
        return false;
 }
+static void carl9170_bar_check(struct ar9170 *ar, struct sk_buff *skb)
+{
+        struct _carl9170_tx_superframe *super = (void *) skb->data;
+        struct ieee80211_bar *bar = (void *) super->frame_data;
+        if (unlikely(ieee80211_is_back_req(bar->frame_control)) &&
+            skb->len >= sizeof(struct ieee80211_bar)) {
+                struct carl9170_bar_list_entry *entry;
+                unsigned int queue = skb_get_queue_mapping(skb);
+                entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
+                if (!WARN_ON_ONCE(!entry)) {
+                        entry->skb = skb;
+                        spin_lock_bh(&ar->bar_list_lock[queue]);
+                        list_add_tail_rcu(&entry->list, &ar->bar_list[queue]);
+                        spin_unlock_bh(&ar->bar_list_lock[queue]);
+                }
+        }
+}
 static void carl9170_tx(struct ar9170 *ar)
 {
        struct sk_buff *skb;
@@ -1287,6 +1348,8 @@ static void carl9170_tx(struct ar9170 *ar)
                        if (unlikely(carl9170_tx_ps_drop(ar, skb)))
                                continue;
+                        carl9170_bar_check(ar, skb);
                        atomic_inc(&ar->tx_total_pending);
                        q = __carl9170_get_queue(ar, i);
diff --git a/drivers/net/wireless/ath/carl9170/version.h b/drivers/net/wireless/ath/carl9170/version.h
index e651db856344..2ec3e9191e4d 100644
--- a/drivers/net/wireless/ath/carl9170/version.h
+++ b/drivers/net/wireless/ath/carl9170/version.h
@@ -1,7 +1,7 @@
 #ifndef __CARL9170_SHARED_VERSION_H
 #define __CARL9170_SHARED_VERSION_H
-#define CARL9170FW_VERSION_YEAR 11
+#define CARL9170FW_VERSION_YEAR 12
-#define CARL9170FW_VERSION_MONTH 8
+#define CARL9170FW_VERSION_MONTH 7
-#define CARL9170FW_VERSION_DAY 15
+#define CARL9170FW_VERSION_DAY 7
-#define CARL9170FW_VERSION_GIT "1.9.4"
+#define CARL9170FW_VERSION_GIT "1.9.6"
 #endif /* __CARL9170_SHARED_VERSION_H */
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index 108118820b36..b92bb9c92ad1 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -1369,7 +1369,7 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
                                        i << 2);
                        b43_nphy_poll_rssi(dev, 2, results[i], 8);
                }
-                for (i = 0; i < 4; i++) {
+                for (i = 0; i < 4; i += 2) {
                        s32 curr;
                        s32 mind = 40;
                        s32 minpoll = 249;
@@ -1415,14 +1415,15 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
                        b43_nphy_scale_offset_rssi(dev, 0, 0, core + 1, 1, i);
                        b43_nphy_poll_rssi(dev, i, poll_results, 8);
                        for (j = 0; j < 4; j++) {
-                                if (j / 2 == core)
+                                if (j / 2 == core) {
                                        offset[j] = 232 - poll_results[j];
-                                if (offset[j] < 0)
+                                        if (offset[j] < 0)
-                                        offset[j] = -(abs(offset[j] + 4) / 8);
+                                                offset[j] = -(abs(offset[j] + 4) / 8);
-                                else
+                                        else
-                                        offset[j] = (offset[j] + 4) / 8;
+                                                offset[j] = (offset[j] + 4) / 8;
-                                b43_nphy_scale_offset_rssi(dev, 0,
+                                        b43_nphy_scale_offset_rssi(dev, 0,
-                                        offset[2 * core], core + 1, j % 2, i);
+                                                offset[2 * core], core + 1, j % 2, i);
+                                }
                        }
                }
        }
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
index 3c6f9b1e8d05..8c9345dd37d2 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
@@ -318,10 +318,6 @@
 #define IS_SIM(chippkg) \
        ((chippkg == HDLSIM_PKG_ID) || (chippkg == HWSIM_PKG_ID))
-#define PCIE(sih)       (ai_get_buscoretype(sih) == PCIE_CORE_ID)
-#define PCI_FORCEHT(sih) (PCIE(sih) && (ai_get_chip_id(sih) == BCM4716_CHIP_ID))
 #ifdef DEBUG
 #define SI_MSG(fmt, ...)        pr_debug(fmt, ##__VA_ARGS__)
 #else
@@ -473,9 +469,6 @@ ai_buscore_setup(struct si_info *sii, struct bcma_device *cc)
                sii->pub.pmurev = sii->pub.pmucaps & PCAP_REV_MASK;
        }
-        /* figure out buscore */
-        sii->buscore = ai_findcore(&sii->pub, PCIE_CORE_ID, 0);
        return true;
 }
@@ -483,11 +476,7 @@ static struct si_info *ai_doattach(struct si_info *sii,
                                   struct bcma_bus *pbus)
 {
        struct si_pub *sih = &sii->pub;
-        u32 w, savewin;
        struct bcma_device *cc;
-        struct ssb_sprom *sprom = &pbus->sprom;
-        savewin = 0;
        sii->icbus = pbus;
        sii->pcibus = pbus->host_pci;
@@ -510,47 +499,7 @@ static struct si_info *ai_doattach(struct si_info *sii,
        /* PMU specific initializations */
        if (ai_get_cccaps(sih) & CC_CAP_PMU) {
-                si_pmu_init(sih);
                (void)si_pmu_measure_alpclk(sih);
-                si_pmu_res_init(sih);
-        }
-        /* setup the GPIO based LED powersave register */
-        w = (sprom->leddc_on_time << BCMA_CC_GPIOTIMER_ONTIME_SHIFT) |
-                 (sprom->leddc_off_time << BCMA_CC_GPIOTIMER_OFFTIME_SHIFT);
-        if (w == 0)
-                w = DEFAULT_GPIOTIMERVAL;
-        ai_cc_reg(sih, offsetof(struct chipcregs, gpiotimerval),
-                  ~0, w);
-        if (ai_get_chip_id(sih) == BCM43224_CHIP_ID) {
-                /*
-                 * enable 12 mA drive strenth for 43224 and
-                 * set chipControl register bit 15
-                 */
-                if (ai_get_chiprev(sih) == 0) {
-                        SI_MSG("Applying 43224A0 WARs\n");
-                        ai_cc_reg(sih, offsetof(struct chipcregs, chipcontrol),
-                                  CCTRL43224_GPIO_TOGGLE,
-                                  CCTRL43224_GPIO_TOGGLE);
-                        si_pmu_chipcontrol(sih, 0, CCTRL_43224A0_12MA_LED_DRIVE,
-                                           CCTRL_43224A0_12MA_LED_DRIVE);
-                }
-                if (ai_get_chiprev(sih) >= 1) {
-                        SI_MSG("Applying 43224B0+ WARs\n");
-                        si_pmu_chipcontrol(sih, 0, CCTRL_43224B0_12MA_LED_DRIVE,
-                                           CCTRL_43224B0_12MA_LED_DRIVE);
-                }
-        }
-        if (ai_get_chip_id(sih) == BCM4313_CHIP_ID) {
-                /*
-                 * enable 12 mA drive strenth for 4313 and
-                 * set chipControl register bit 1
-                 */
-                SI_MSG("Applying 4313 WARs\n");
-                si_pmu_chipcontrol(sih, 0, CCTRL_4313_12MA_LED_DRIVE,
-                                   CCTRL_4313_12MA_LED_DRIVE);
        }
        return sii;
@@ -589,7 +538,7 @@ void ai_detach(struct si_pub *sih)
        struct si_pub *si_local = NULL;
        memcpy(&si_local, &sih, sizeof(struct si_pub **));
-        sii = (struct si_info *)sih;
+        sii = container_of(sih, struct si_info, pub);
        if (sii == NULL)
                return;
@@ -597,27 +546,6 @@ void ai_detach(struct si_pub *sih)
        kfree(sii);
 }
-/* return index of coreid or BADIDX if not found */
-struct bcma_device *ai_findcore(struct si_pub *sih, u16 coreid, u16 coreunit)
-{
-        struct bcma_device *core;
-        struct si_info *sii;
-        uint found;
-        sii = (struct si_info *)sih;
-        found = 0;
-        list_for_each_entry(core, &sii->icbus->cores, list)
-                if (core->id.id == coreid) {
-                        if (found == coreunit)
-                                return core;
-                        found++;
-                }
-        return NULL;
-}
 /*
 * read/modify chipcommon core register.
 */
@@ -627,7 +555,7 @@ uint ai_cc_reg(struct si_pub *sih, uint regoff, u32 mask, u32 val)
        u32 w;
        struct si_info *sii;
-        sii = (struct si_info *)sih;
+        sii = container_of(sih, struct si_info, pub);
        cc = sii->icbus->drv_cc.core;
        /* mask and set */
@@ -693,12 +621,13 @@ ai_clkctl_setdelay(struct si_pub *sih, struct bcma_device *cc)
 /* initialize power control delay registers */
 void ai_clkctl_init(struct si_pub *sih)
 {
+        struct si_info *sii = container_of(sih, struct si_info, pub);
        struct bcma_device *cc;
        if (!(ai_get_cccaps(sih) & CC_CAP_PWR_CTL))
                return;
-        cc = ai_findcore(sih, BCMA_CORE_CHIPCOMMON, 0);
+        cc = sii->icbus->drv_cc.core;
        if (cc == NULL)
                return;
@@ -720,7 +649,7 @@ u16 ai_clkctl_fast_pwrup_delay(struct si_pub *sih)
        uint slowminfreq;
        u16 fpdelay;
-        sii = (struct si_info *)sih;
+        sii = container_of(sih, struct si_info, pub);
        if (ai_get_cccaps(sih) & CC_CAP_PMU) {
                fpdelay = si_pmu_fast_pwrup_delay(sih);
                return fpdelay;
@@ -730,7 +659,7 @@ u16 ai_clkctl_fast_pwrup_delay(struct si_pub *sih)
                return 0;
        fpdelay = 0;
-        cc = ai_findcore(sih, CC_CORE_ID, 0);
+        cc = sii->icbus->drv_cc.core;
        if (cc) {
                slowminfreq = ai_slowclk_freq(sih, false, cc);
                fpdelay = (((bcma_read32(cc, CHIPCREGOFFS(pll_on_delay)) + 2)
@@ -752,12 +681,9 @@ bool ai_clkctl_cc(struct si_pub *sih, enum bcma_clkmode mode)
        struct si_info *sii;
        struct bcma_device *cc;
-        sii = (struct si_info *)sih;
+        sii = container_of(sih, struct si_info, pub);
-        if (PCI_FORCEHT(sih))
-                return mode == BCMA_CLKMODE_FAST;
-        cc = ai_findcore(&sii->pub, BCMA_CORE_CHIPCOMMON, 0);
+        cc = sii->icbus->drv_cc.core;
        bcma_core_set_clockmode(cc, mode);
        return mode == BCMA_CLKMODE_FAST;
 }
@@ -765,16 +691,10 @@ bool ai_clkctl_cc(struct si_pub *sih, enum bcma_clkmode mode)
 void ai_pci_up(struct si_pub *sih)
 {
        struct si_info *sii;
-        struct bcma_device *cc;
-        sii = (struct si_info *)sih;
+        sii = container_of(sih, struct si_info, pub);
-        if (PCI_FORCEHT(sih)) {
+        if (sii->icbus->hosttype == BCMA_HOSTTYPE_PCI)
-                cc = ai_findcore(&sii->pub, BCMA_CORE_CHIPCOMMON, 0);
-                bcma_core_set_clockmode(cc, BCMA_CLKMODE_FAST);
-        }
-        if (PCIE(sih))
                bcma_core_pci_extend_L1timer(&sii->icbus->drv_pci, true);
 }
@@ -782,26 +702,20 @@ void ai_pci_up(struct si_pub *sih)
 void ai_pci_down(struct si_pub *sih)
 {
        struct si_info *sii;
-        struct bcma_device *cc;
-        sii = (struct si_info *)sih;
+        sii = container_of(sih, struct si_info, pub);
-        /* release FORCEHT since chip is going to "down" state */
+        if (sii->icbus->hosttype == BCMA_HOSTTYPE_PCI)
-        if (PCI_FORCEHT(sih)) {
-                cc = ai_findcore(&sii->pub, BCMA_CORE_CHIPCOMMON, 0);
-                bcma_core_set_clockmode(cc, BCMA_CLKMODE_DYNAMIC);
-        }
-        if (PCIE(sih))
                bcma_core_pci_extend_L1timer(&sii->icbus->drv_pci, false);
 }
 /* Enable BT-COEX & Ex-PA for 4313 */
 void ai_epa_4313war(struct si_pub *sih)
 {
+        struct si_info *sii = container_of(sih, struct si_info, pub);
        struct bcma_device *cc;
-        cc = ai_findcore(sih, CC_CORE_ID, 0);
+        cc = sii->icbus->drv_cc.core;
        /* EPA Fix */
        bcma_set32(cc, CHIPCREGOFFS(gpiocontrol), GPIO_CTRL_EPA_EN_MASK);
@@ -813,7 +727,7 @@ bool ai_deviceremoved(struct si_pub *sih)
        u32 w;
        struct si_info *sii;
-        sii = (struct si_info *)sih;
+        sii = container_of(sih, struct si_info, pub);
        if (sii->icbus->hosttype != BCMA_HOSTTYPE_PCI)
                return false;
@@ -824,15 +738,3 @@ bool ai_deviceremoved(struct si_pub *sih)
        return false;
 }
-uint ai_get_buscoretype(struct si_pub *sih)
-{
-        struct si_info *sii = (struct si_info *)sih;
-        return sii->buscore->id.id;
-}
-uint ai_get_buscorerev(struct si_pub *sih)
-{
-        struct si_info *sii = (struct si_info *)sih;
-        return sii->buscore->id.rev;
-}
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h
index d6fa9829af9a..89562c1fbf49 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h
@@ -88,16 +88,6 @@
 #define CLKD_OTP                0x000f0000
 #define CLKD_OTP_SHIFT          16
-/* Package IDs */
-#define BCM4717_PKG_ID          9       /* 4717 package id */
-#define BCM4718_PKG_ID          10      /* 4718 package id */
-#define BCM43224_FAB_SMIC       0xa     /* the chip is manufactured by SMIC */
-/* these are router chips */
-#define BCM4716_CHIP_ID         0x4716  /* 4716 chipcommon chipid */
-#define BCM47162_CHIP_ID        47162   /* 47162 chipcommon chipid */
-#define BCM4748_CHIP_ID         0x4748  /* 4716 chipcommon chipid (OTP, RBBU) */
 /* dynamic clock control defines */
 #define LPOMINFREQ              25000   /* low power oscillator min */
 #define LPOMAXFREQ              43000   /* low power oscillator max */
@@ -168,7 +158,6 @@ struct si_info {
        struct si_pub pub;      /* back plane public state (must be first) */
        struct bcma_bus *icbus; /* handle to soc interconnect bus */
        struct pci_dev *pcibus; /* handle to pci bus */
-        struct bcma_device *buscore;
        u32 chipst;             /* chip status */
 };
@@ -183,8 +172,6 @@ struct si_info {
 /* AMBA Interconnect exported externs */
-extern struct bcma_device *ai_findcore(struct si_pub *sih,
-                                       u16 coreid, u16 coreunit);
 extern u32 ai_core_cflags(struct bcma_device *core, u32 mask, u32 val);
 /* === exported functions === */
@@ -202,9 +189,6 @@ extern void ai_pci_up(struct si_pub *sih);
 /* Enable Ex-PA for 4313 */
 extern void ai_epa_4313war(struct si_pub *sih);
-extern uint ai_get_buscoretype(struct si_pub *sih);
-extern uint ai_get_buscorerev(struct si_pub *sih);
 static inline u32 ai_get_cccaps(struct si_pub *sih)
 {
        return sih->cccaps;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/channel.c b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
index 2d365d3486df..9a4c63f927cb 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/channel.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
@@ -763,20 +763,17 @@ void brcms_c_regd_init(struct brcms_c_info *wlc)
        int band_idx, i;
        /* Disable any channels not supported by the phy */
-        for (band_idx = 0; band_idx < IEEE80211_NUM_BANDS; band_idx++) {
+        for (band_idx = 0; band_idx < wlc->pub->_nbands; band_idx++) {
-                if (band_idx == IEEE80211_BAND_2GHZ)
+                band = wlc->bandstate[band_idx];
-                        band = wlc->bandstate[BAND_2G_INDEX];
-                else
-                        band = wlc->bandstate[BAND_5G_INDEX];
-                /* skip if band not initialized */
-                if (band->pi == NULL)
-                        continue;
                wlc_phy_chanspec_band_validch(band->pi, band->bandtype,
                                              &sup_chan);
-                sband = wiphy->bands[band_idx];
+                if (band_idx == BAND_2G_INDEX)
+                        sband = wiphy->bands[IEEE80211_BAND_2GHZ];
+                else
+                        sband = wiphy->bands[IEEE80211_BAND_5GHZ];
                for (i = 0; i < sband->n_channels; i++) {
                        ch = &sband->channels[i];
                        if (!isset(sup_chan.vec, ch->hw_value))
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/dma.c b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
index 7516639412ec..5e53305bd9a9 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
@@ -573,6 +573,7 @@ struct dma_pub *dma_attach(char *name, struct si_pub *sih,
        struct dma_info *di;
        u8 rev = core->id.rev;
        uint size;
+        struct si_info *sii = container_of(sih, struct si_info, pub);
        /* allocate private info structure */
        di = kzalloc(sizeof(struct dma_info), GFP_ATOMIC);
@@ -633,16 +634,20 @@ struct dma_pub *dma_attach(char *name, struct si_pub *sih,
         */
        di->ddoffsetlow = 0;
        di->dataoffsetlow = 0;
-        /* add offset for pcie with DMA64 bus */
+        /* for pci bus, add offset */
-        di->ddoffsetlow = 0;
+        if (sii->icbus->hosttype == BCMA_HOSTTYPE_PCI) {
-        di->ddoffsethigh = SI_PCIE_DMA_H32;
+                /* add offset for pcie with DMA64 bus */
+                di->ddoffsetlow = 0;
+                di->ddoffsethigh = SI_PCIE_DMA_H32;
+        }
        di->dataoffsetlow = di->ddoffsetlow;
        di->dataoffsethigh = di->ddoffsethigh;
        /* WAR64450 : DMACtl.Addr ext fields are not supported in SDIOD core. */
-        if ((core->id.id == SDIOD_CORE_ID)
+        if ((core->id.id == BCMA_CORE_SDIO_DEV)
            && ((rev > 0) && (rev <= 2)))
                di->addrext = false;
-        else if ((core->id.id == I2S_CORE_ID) &&
+        else if ((core->id.id == BCMA_CORE_I2S) &&
                 ((rev == 0) || (rev == 1)))
                di->addrext = false;
        else
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 2d5a40412690..2b57f57a7927 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -319,8 +319,7 @@ static void brcms_ops_stop(struct ieee80211_hw *hw)
                return;
        spin_lock_bh(&wl->lock);
-        status = brcms_c_chipmatch(wl->wlc->hw->vendorid,
+        status = brcms_c_chipmatch(wl->wlc->hw->d11core);
-                                   wl->wlc->hw->deviceid);
        spin_unlock_bh(&wl->lock);
        if (!status) {
                wiphy_err(wl->wiphy,
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index bb00b6528d8f..cb73f2250b11 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -269,7 +269,7 @@ struct brcms_c_bit_desc {
 */
 /* Starting corerev for the fifo size table */
-#define XMTFIFOTBL_STARTREV     20
+#define XMTFIFOTBL_STARTREV     17
 struct d11init {
        __le16 addr;
@@ -333,6 +333,12 @@ const u8 wlc_prio2prec_map[] = {
 };
 static const u16 xmtfifo_sz[][NFIFO] = {
+        /* corerev 17: 5120, 49152, 49152, 5376, 4352, 1280 */
+        {20, 192, 192, 21, 17, 5},
+        /* corerev 18: */
+        {0, 0, 0, 0, 0, 0},
+        /* corerev 19: */
+        {0, 0, 0, 0, 0, 0},
        /* corerev 20: 5120, 49152, 49152, 5376, 4352, 1280 */
        {20, 192, 192, 21, 17, 5},
        /* corerev 21: 2304, 14848, 5632, 3584, 3584, 1280 */
@@ -343,6 +349,14 @@ static const u16 xmtfifo_sz[][NFIFO] = {
        {20, 192, 192, 21, 17, 5},
        /* corerev 24: 2304, 14848, 5632, 3584, 3584, 1280 */
        {9, 58, 22, 14, 14, 5},
+        /* corerev 25: */
+        {0, 0, 0, 0, 0, 0},
+        /* corerev 26: */
+        {0, 0, 0, 0, 0, 0},
+        /* corerev 27: */
+        {0, 0, 0, 0, 0, 0},
+        /* corerev 28: 2304, 14848, 5632, 3584, 3584, 1280 */
+        {9, 58, 22, 14, 14, 5},
 };
 #ifdef DEBUG
@@ -1942,7 +1956,8 @@ static bool brcms_b_radio_read_hwdisabled(struct brcms_hardware *wlc_hw)
                 * accesses phyreg throughput mac. This can be skipped since
                 * only mac reg is accessed below
                 */
-                flags |= SICF_PCLKE;
+                if (D11REV_GE(wlc_hw->corerev, 18))
+                        flags |= SICF_PCLKE;
                /*
                 * TODO: test suspend/resume
@@ -2023,7 +2038,8 @@ void brcms_b_corereset(struct brcms_hardware *wlc_hw, u32 flags)
         * phyreg throughput mac, AND phy_reset is skipped at early stage when
         * band->pi is invalid. need to enable PHY CLK
         */
-        flags |= SICF_PCLKE;
+        if (D11REV_GE(wlc_hw->corerev, 18))
+                flags |= SICF_PCLKE;
        /*
         * reset the core
@@ -2126,8 +2142,8 @@ void brcms_b_switch_macfreq(struct brcms_hardware *wlc_hw, u8 spurmode)
 {
        struct bcma_device *core = wlc_hw->d11core;
-        if ((ai_get_chip_id(wlc_hw->sih) == BCM43224_CHIP_ID) ||
+        if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43224) ||
-            (ai_get_chip_id(wlc_hw->sih) == BCM43225_CHIP_ID)) {
+            (ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43225)) {
                if (spurmode == WL_SPURAVOID_ON2) {     /* 126Mhz */
                        bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x2082);
                        bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
@@ -2791,7 +2807,7 @@ void brcms_b_core_phypll_ctl(struct brcms_hardware *wlc_hw, bool on)
        tmp = 0;
        if (on) {
-                if ((ai_get_chip_id(wlc_hw->sih) == BCM4313_CHIP_ID)) {
+                if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM4313)) {
                        bcma_set32(core, D11REGOFFS(clk_ctl_st),
                                   CCS_ERSRC_REQ_HT |
                                   CCS_ERSRC_REQ_D11PLL |
@@ -4218,9 +4234,8 @@ static void brcms_c_radio_timer(void *arg)
 }
 /* common low-level watchdog code */
-static void brcms_b_watchdog(void *arg)
+static void brcms_b_watchdog(struct brcms_c_info *wlc)
 {
-        struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
        struct brcms_hardware *wlc_hw = wlc->hw;
        BCMMSG(wlc->wiphy, "wl%d\n", wlc_hw->unit);
@@ -4241,10 +4256,8 @@ static void brcms_b_watchdog(void *arg)
 }
 /* common watchdog code */
-static void brcms_c_watchdog(void *arg)
+static void brcms_c_watchdog(struct brcms_c_info *wlc)
 {
-        struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
        BCMMSG(wlc->wiphy, "wl%d\n", wlc->pub->unit);
        if (!wlc->pub->up)
@@ -4284,7 +4297,9 @@ static void brcms_c_watchdog(void *arg)
 static void brcms_c_watchdog_by_timer(void *arg)
 {
-        brcms_c_watchdog(arg);
+        struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
+        brcms_c_watchdog(wlc);
 }
 static bool brcms_c_timers_init(struct brcms_c_info *wlc, int unit)
@@ -4454,11 +4469,9 @@ static int brcms_b_attach(struct brcms_c_info *wlc, struct bcma_device *core,
        }
        /* verify again the device is supported */
-        if (core->bus->hosttype == BCMA_HOSTTYPE_PCI &&
+        if (!brcms_c_chipmatch(core)) {
-            !brcms_c_chipmatch(pcidev->vendor, pcidev->device)) {
+                wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported device\n",
-                wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported "
+                         unit);
-                        "vendor/device (0x%x/0x%x)\n",
-                         unit, pcidev->vendor, pcidev->device);
                err = 12;
                goto fail;
        }
@@ -4528,7 +4541,7 @@ static int brcms_b_attach(struct brcms_c_info *wlc, struct bcma_device *core,
        else
                wlc_hw->_nbands = 1;
-        if ((ai_get_chip_id(wlc_hw->sih) == BCM43225_CHIP_ID))
+        if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43225))
                wlc_hw->_nbands = 1;
        /* BMAC_NOTE: remove init of pub values when brcms_c_attach()
@@ -4595,8 +4608,12 @@ static int brcms_b_attach(struct brcms_c_info *wlc, struct bcma_device *core,
                wlc_hw->machwcap_backup = wlc_hw->machwcap;
                /* init tx fifo size */
+                WARN_ON((wlc_hw->corerev - XMTFIFOTBL_STARTREV) < 0 ||
+                        (wlc_hw->corerev - XMTFIFOTBL_STARTREV) >
+                                ARRAY_SIZE(xmtfifo_sz));
                wlc_hw->xmtfifo_sz =
                    xmtfifo_sz[(wlc_hw->corerev - XMTFIFOTBL_STARTREV)];
+                WARN_ON(!wlc_hw->xmtfifo_sz[0]);
                /* Get a phy for this band */
                wlc_hw->band->pi =
@@ -5036,7 +5053,7 @@ static void brcms_b_hw_up(struct brcms_hardware *wlc_hw)
        wlc_hw->wlc->pub->hw_up = true;
        if ((wlc_hw->boardflags & BFL_FEM)
-            && (ai_get_chip_id(wlc_hw->sih) == BCM4313_CHIP_ID)) {
+            && (ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM4313)) {
                if (!
                    (wlc_hw->boardrev >= 0x1250
                     && (wlc_hw->boardflags & BFL_FEM_BT)))
@@ -5130,7 +5147,7 @@ int brcms_c_up(struct brcms_c_info *wlc)
        }
        if ((wlc->pub->boardflags & BFL_FEM)
-            && (ai_get_chip_id(wlc->hw->sih) == BCM4313_CHIP_ID)) {
+            && (ai_get_chip_id(wlc->hw->sih) == BCMA_CHIP_ID_BCM4313)) {
                if (wlc->pub->boardrev >= 0x1250
                    && (wlc->pub->boardflags & BFL_FEM_BT))
                        brcms_b_mhf(wlc->hw, MHF5, MHF5_4313_GPIOCTRL,
@@ -5767,8 +5784,12 @@ void brcms_c_print_txstatus(struct tx_status *txs)
                 (txs->ackphyrxsh & PRXS1_SQ_MASK) >> PRXS1_SQ_SHIFT);
 }
-bool brcms_c_chipmatch(u16 vendor, u16 device)
+static bool brcms_c_chipmatch_pci(struct bcma_device *core)
 {
+        struct pci_dev *pcidev = core->bus->host_pci;
+        u16 vendor = pcidev->vendor;
+        u16 device = pcidev->device;
        if (vendor != PCI_VENDOR_ID_BROADCOM) {
                pr_err("unknown vendor id %04x\n", vendor);
                return false;
@@ -5787,6 +5808,30 @@ bool brcms_c_chipmatch(u16 vendor, u16 device)
        return false;
 }
+static bool brcms_c_chipmatch_soc(struct bcma_device *core)
+{
+        struct bcma_chipinfo *chipinfo = &core->bus->chipinfo;
+        if (chipinfo->id == BCMA_CHIP_ID_BCM4716)
+                return true;
+        pr_err("unknown chip id %04x\n", chipinfo->id);
+        return false;
+}
+bool brcms_c_chipmatch(struct bcma_device *core)
+{
+        switch (core->bus->hosttype) {
+        case BCMA_HOSTTYPE_PCI:
+                return brcms_c_chipmatch_pci(core);
+        case BCMA_HOSTTYPE_SOC:
+                return brcms_c_chipmatch_soc(core);
+        default:
+                pr_err("unknown host type: %i\n", core->bus->hosttype);
+                return false;
+        }
+}
 #if defined(DEBUG)
 void brcms_c_print_txdesc(struct d11txh *txh)
 {
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_cmn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_cmn.c
index 264f8c4c703d..91937c5025ce 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_cmn.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_cmn.c
@@ -198,6 +198,8 @@ u16 read_radio_reg(struct brcms_phy *pi, u16 addr)
 void write_radio_reg(struct brcms_phy *pi, u16 addr, u16 val)
 {
+        struct si_info *sii = container_of(pi->sh->sih, struct si_info, pub);
        if ((D11REV_GE(pi->sh->corerev, 24)) ||
            (D11REV_IS(pi->sh->corerev, 22)
             && (pi->pubpi.phy_type != PHY_TYPE_SSN))) {
@@ -209,7 +211,8 @@ void write_radio_reg(struct brcms_phy *pi, u16 addr, u16 val)
                bcma_write16(pi->d11core, D11REGOFFS(phy4wdatalo), val);
        }
-        if (++pi->phy_wreg >= pi->phy_wreg_limit) {
+        if ((sii->icbus->hosttype == BCMA_HOSTTYPE_PCI) &&
+            (++pi->phy_wreg >= pi->phy_wreg_limit)) {
                (void)bcma_read32(pi->d11core, D11REGOFFS(maccontrol));
                pi->phy_wreg = 0;
        }
@@ -292,10 +295,13 @@ void write_phy_reg(struct brcms_phy *pi, u16 addr, u16 val)
        bcma_wflush16(pi->d11core, D11REGOFFS(phyregaddr), addr);
        bcma_write16(pi->d11core, D11REGOFFS(phyregdata), val);
        if (addr == 0x72)
-                (void)bcma_read16(pi->d11core, D11REGOFFS(phyversion));
+                (void)bcma_read16(pi->d11core, D11REGOFFS(phyregdata));
 #else
+        struct si_info *sii = container_of(pi->sh->sih, struct si_info, pub);
        bcma_write32(pi->d11core, D11REGOFFS(phyregaddr), addr | (val << 16));
-        if (++pi->phy_wreg >= pi->phy_wreg_limit) {
+        if ((sii->icbus->hosttype == BCMA_HOSTTYPE_PCI) &&
+            (++pi->phy_wreg >= pi->phy_wreg_limit)) {
                pi->phy_wreg = 0;
                (void)bcma_read16(pi->d11core, D11REGOFFS(phyversion));
        }
@@ -837,7 +843,7 @@ wlc_phy_table_addr(struct brcms_phy *pi, uint tbl_id, uint tbl_offset,
        pi->tbl_data_hi = tblDataHi;
        pi->tbl_data_lo = tblDataLo;
-        if (pi->sh->chip == BCM43224_CHIP_ID &&
+        if (pi->sh->chip == BCMA_CHIP_ID_BCM43224 &&
            pi->sh->chiprev == 1) {
                pi->tbl_addr = tblAddr;
                pi->tbl_save_id = tbl_id;
@@ -847,7 +853,7 @@ wlc_phy_table_addr(struct brcms_phy *pi, uint tbl_id, uint tbl_offset,
 void wlc_phy_table_data_write(struct brcms_phy *pi, uint width, u32 val)
 {
-        if ((pi->sh->chip == BCM43224_CHIP_ID) &&
+        if ((pi->sh->chip == BCMA_CHIP_ID_BCM43224) &&
            (pi->sh->chiprev == 1) &&
            (pi->tbl_save_id == NPHY_TBL_ID_ANTSWCTRLLUT)) {
                read_phy_reg(pi, pi->tbl_data_lo);
@@ -881,7 +887,7 @@ wlc_phy_write_table(struct brcms_phy *pi, const struct phytbl_info *ptbl_info,
        for (idx = 0; idx < ptbl_info->tbl_len; idx++) {
-                if ((pi->sh->chip == BCM43224_CHIP_ID) &&
+                if ((pi->sh->chip == BCMA_CHIP_ID_BCM43224) &&
                    (pi->sh->chiprev == 1) &&
                    (tbl_id == NPHY_TBL_ID_ANTSWCTRLLUT)) {
                        read_phy_reg(pi, tblDataLo);
@@ -918,7 +924,7 @@ wlc_phy_read_table(struct brcms_phy *pi, const struct phytbl_info *ptbl_info,
        for (idx = 0; idx < ptbl_info->tbl_len; idx++) {
-                if ((pi->sh->chip == BCM43224_CHIP_ID) &&
+                if ((pi->sh->chip == BCMA_CHIP_ID_BCM43224) &&
                    (pi->sh->chiprev == 1)) {
                        (void)read_phy_reg(pi, tblDataLo);
@@ -2894,7 +2900,7 @@ const u8 *wlc_phy_get_ofdm_rate_lookup(void)
 void wlc_lcnphy_epa_switch(struct brcms_phy *pi, bool mode)
 {
-        if ((pi->sh->chip == BCM4313_CHIP_ID) &&
+        if ((pi->sh->chip == BCMA_CHIP_ID_BCM4313) &&
            (pi->sh->boardflags & BFL_FEM)) {
                if (mode) {
                        u16 txant = 0;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
index 366718146418..65db9b7458dc 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
@@ -17893,6 +17893,8 @@ static u32 *wlc_phy_get_ipa_gaintbl_nphy(struct brcms_phy *pi)
                                        nphy_tpc_txgain_ipa_2g_2057rev7;
                } else if (NREV_IS(pi->pubpi.phy_rev, 6)) {
                        tx_pwrctrl_tbl = nphy_tpc_txgain_ipa_rev6;
+                        if (pi->sh->chip == BCMA_CHIP_ID_BCM47162)
+                                tx_pwrctrl_tbl = nphy_tpc_txgain_ipa_rev5;
                } else if (NREV_IS(pi->pubpi.phy_rev, 5)) {
                        tx_pwrctrl_tbl = nphy_tpc_txgain_ipa_rev5;
                } else {
@@ -19254,8 +19256,14 @@ static void wlc_phy_spurwar_nphy(struct brcms_phy *pi)
                        case 38:
                        case 102:
                        case 118:
-                                nphy_adj_tone_id_buf[0] = 0;
+                                if ((pi->sh->chip == BCMA_CHIP_ID_BCM4716) &&
-                                nphy_adj_noise_var_buf[0] = 0x0;
+                                    (pi->sh->chippkg == BCMA_PKG_ID_BCM4717)) {
+                                        nphy_adj_tone_id_buf[0] = 32;
+                                        nphy_adj_noise_var_buf[0] = 0x21f;
+                                } else {
+                                        nphy_adj_tone_id_buf[0] = 0;
+                                        nphy_adj_noise_var_buf[0] = 0x0;
+                                }
                                break;
                        case 134:
                                nphy_adj_tone_id_buf[0] = 32;
@@ -19309,8 +19317,8 @@ void wlc_phy_init_nphy(struct brcms_phy *pi)
                pi->measure_hold |= PHY_HOLD_FOR_NOT_ASSOC;
        if ((ISNPHY(pi)) && (NREV_GE(pi->pubpi.phy_rev, 5)) &&
-            ((pi->sh->chippkg == BCM4717_PKG_ID) ||
+            ((pi->sh->chippkg == BCMA_PKG_ID_BCM4717) ||
-             (pi->sh->chippkg == BCM4718_PKG_ID))) {
+             (pi->sh->chippkg == BCMA_PKG_ID_BCM4718))) {
                if ((pi->sh->boardflags & BFL_EXTLNA) &&
                    (CHSPEC_IS2G(pi->radio_chanspec)))
                        ai_cc_reg(pi->sh->sih,
@@ -19318,6 +19326,10 @@ void wlc_phy_init_nphy(struct brcms_phy *pi)
                                  0x40, 0x40);
        }
+        if ((!PHY_IPA(pi)) && (pi->sh->chip == BCMA_CHIP_ID_BCM5357))
+                si_pmu_chipcontrol(pi->sh->sih, 1, CCTRL5357_EXTPA,
+                                   CCTRL5357_EXTPA);
        if ((pi->nphy_gband_spurwar2_en) && CHSPEC_IS2G(pi->radio_chanspec) &&
            CHSPEC_IS40(pi->radio_chanspec)) {
@@ -20695,12 +20707,22 @@ wlc_phy_chanspec_radio2056_setup(struct brcms_phy *pi,
                        write_radio_reg(pi, RADIO_2056_SYN_PLL_LOOPFILTER2 |
                                        RADIO_2056_SYN, 0x1f);
-                        write_radio_reg(pi,
+                        if ((pi->sh->chip == BCMA_CHIP_ID_BCM4716) ||
-                                        RADIO_2056_SYN_PLL_LOOPFILTER4 |
+                            (pi->sh->chip == BCMA_CHIP_ID_BCM47162)) {
-                                        RADIO_2056_SYN, 0xb);
+                                write_radio_reg(pi,
-                        write_radio_reg(pi,
+                                                RADIO_2056_SYN_PLL_LOOPFILTER4 |
-                                        RADIO_2056_SYN_PLL_CP2 |
+                                                RADIO_2056_SYN, 0x14);
-                                        RADIO_2056_SYN, 0x14);
+                                write_radio_reg(pi,
+                                                RADIO_2056_SYN_PLL_CP2 |
+                                                RADIO_2056_SYN, 0x00);
+                        } else {
+                                write_radio_reg(pi,
+                                                RADIO_2056_SYN_PLL_LOOPFILTER4 |
+                                                RADIO_2056_SYN, 0xb);
+                                write_radio_reg(pi,
+                                                RADIO_2056_SYN_PLL_CP2 |
+                                                RADIO_2056_SYN, 0x14);
+                        }
                }
        }
@@ -20747,24 +20769,30 @@ wlc_phy_chanspec_radio2056_setup(struct brcms_phy *pi,
                                WRITE_RADIO_REG2(pi, RADIO_2056, TX, core,
                                                 PADG_IDAC, 0xcc);
-                                bias = 0x25;
+                                if ((pi->sh->chip == BCMA_CHIP_ID_BCM4716) ||
-                                cascbias = 0x20;
+                                    (pi->sh->chip == BCMA_CHIP_ID_BCM47162)) {
+                                        bias = 0x40;
+                                        cascbias = 0x45;
+                                        pag_boost_tune = 0x5;
+                                        pgag_boost_tune = 0x33;
+                                        padg_boost_tune = 0x77;
+                                        mixg_boost_tune = 0x55;
+                                } else {
+                                        bias = 0x25;
+                                        cascbias = 0x20;
-                                if ((pi->sh->chip ==
+                                        if ((pi->sh->chip == BCMA_CHIP_ID_BCM43224 ||
-                                     BCM43224_CHIP_ID)
+                                             pi->sh->chip == BCMA_CHIP_ID_BCM43225) &&
-                                    || (pi->sh->chip ==
+                                            pi->sh->chippkg == BCMA_PKG_ID_BCM43224_FAB_SMIC) {
-                                        BCM43225_CHIP_ID)) {
-                                        if (pi->sh->chippkg ==
-                                            BCM43224_FAB_SMIC) {
                                                bias = 0x2a;
                                                cascbias = 0x38;
                                        }
-                                }
-                                pag_boost_tune = 0x4;
+                                        pag_boost_tune = 0x4;
-                                pgag_boost_tune = 0x03;
+                                        pgag_boost_tune = 0x03;
-                                padg_boost_tune = 0x77;
+                                        padg_boost_tune = 0x77;
-                                mixg_boost_tune = 0x65;
+                                        mixg_boost_tune = 0x65;
+                                }
                                WRITE_RADIO_REG2(pi, RADIO_2056, TX, core,
                                                 INTPAG_IMAIN_STAT, bias);
@@ -20863,11 +20891,10 @@ wlc_phy_chanspec_radio2056_setup(struct brcms_phy *pi,
                        cascbias = 0x30;
-                        if ((pi->sh->chip == BCM43224_CHIP_ID) ||
+                        if ((pi->sh->chip == BCMA_CHIP_ID_BCM43224 ||
-                            (pi->sh->chip == BCM43225_CHIP_ID)) {
+                             pi->sh->chip == BCMA_CHIP_ID_BCM43225) &&
-                                if (pi->sh->chippkg == BCM43224_FAB_SMIC)
+                            pi->sh->chippkg == BCMA_PKG_ID_BCM43224_FAB_SMIC)
-                                        cascbias = 0x35;
+                                cascbias = 0x35;
-                        }
                        pabias = (pi->phy_pabias == 0) ? 0x30 : pi->phy_pabias;
@@ -21106,6 +21133,7 @@ wlc_phy_chanspec_nphy_setup(struct brcms_phy *pi, u16 chanspec,
                            const struct nphy_sfo_cfg *ci)
 {
        u16 val;
+        struct si_info *sii = container_of(pi->sh->sih, struct si_info, pub);
        val = read_phy_reg(pi, 0x09) & NPHY_BandControl_currentBand;
        if (CHSPEC_IS5G(chanspec) && !val) {
@@ -21178,22 +21206,32 @@ wlc_phy_chanspec_nphy_setup(struct brcms_phy *pi, u16 chanspec,
                } else if (NREV_GE(pi->pubpi.phy_rev, 7)) {
                        if (val == 54)
                                spuravoid = 1;
-                } else {
+                } else if (pi->nphy_aband_spurwar_en &&
-                        if (pi->nphy_aband_spurwar_en &&
+                    ((val == 38) || (val == 102) || (val == 118))) {
-                            ((val == 38) || (val == 102)
+                        if ((pi->sh->chip == BCMA_CHIP_ID_BCM4716)
-                             || (val == 118)))
+                            && (pi->sh->chippkg == BCMA_PKG_ID_BCM4717)) {
+                                spuravoid = 0;
+                        } else {
                                spuravoid = 1;
+                        }
                }
                if (pi->phy_spuravoid == SPURAVOID_FORCEON)
                        spuravoid = 1;
-                wlapi_bmac_core_phypll_ctl(pi->sh->physhim, false);
+                if ((pi->sh->chip == BCMA_CHIP_ID_BCM4716) ||
-                si_pmu_spuravoid_pllupdate(pi->sh->sih, spuravoid);
+                    (pi->sh->chip == BCMA_CHIP_ID_BCM43225)) {
-                wlapi_bmac_core_phypll_ctl(pi->sh->physhim, true);
+                        bcma_pmu_spuravoid_pllupdate(&sii->icbus->drv_cc,
+                                                     spuravoid);
+                } else {
+                        wlapi_bmac_core_phypll_ctl(pi->sh->physhim, false);
+                        bcma_pmu_spuravoid_pllupdate(&sii->icbus->drv_cc,
+                                                     spuravoid);
+                        wlapi_bmac_core_phypll_ctl(pi->sh->physhim, true);
+                }
-                if ((pi->sh->chip == BCM43224_CHIP_ID) ||
+                if ((pi->sh->chip == BCMA_CHIP_ID_BCM43224) ||
-                    (pi->sh->chip == BCM43225_CHIP_ID)) {
+                    (pi->sh->chip == BCMA_CHIP_ID_BCM43225)) {
                        if (spuravoid == 1) {
                                bcma_write16(pi->d11core,
                                             D11REGOFFS(tsf_clk_frac_l),
@@ -21209,7 +21247,9 @@ wlc_phy_chanspec_nphy_setup(struct brcms_phy *pi, u16 chanspec,
                        }
                }
-                wlapi_bmac_core_phypll_reset(pi->sh->physhim);
+                if (!((pi->sh->chip == BCMA_CHIP_ID_BCM4716) ||
+                      (pi->sh->chip == BCMA_CHIP_ID_BCM47162)))
+                        wlapi_bmac_core_phypll_reset(pi->sh->physhim);
                mod_phy_reg(pi, 0x01, (0x1 << 15),
                            ((spuravoid > 0) ? (0x1 << 15) : 0));
@@ -22171,9 +22211,15 @@ s16 wlc_phy_tempsense_nphy(struct brcms_phy *pi)
                wlc_phy_table_write_nphy(pi, NPHY_TBL_ID_AFECTRL, 1, 0x03, 16,
                                         &auxADC_rssi_ctrlH_save);
-                radio_temp[0] = (179 * (radio_temp[1] + radio_temp2[1])
+                if (pi->sh->chip == BCMA_CHIP_ID_BCM5357) {
-                                 + 82 * (auxADC_Vl) - 28861 +
+                        radio_temp[0] = (193 * (radio_temp[1] + radio_temp2[1])
-                                 128) / 256;
+                                         + 88 * (auxADC_Vl) - 27111 +
+                                         128) / 256;
+                } else {
+                        radio_temp[0] = (179 * (radio_temp[1] + radio_temp2[1])
+                                         + 82 * (auxADC_Vl) - 28861 +
+                                         128) / 256;
+                }
                offset = (s16) pi->phy_tempsense_offset;
@@ -24923,14 +24969,16 @@ wlc_phy_a2_nphy(struct brcms_phy *pi, struct nphy_ipa_txcalgains *txgains,
                        if (txgains->useindex) {
                                phy_a4 = 15 - ((txgains->index) >> 3);
                                if (CHSPEC_IS2G(pi->radio_chanspec)) {
-                                        if (NREV_GE(pi->pubpi.phy_rev, 6))
+                                        if (NREV_GE(pi->pubpi.phy_rev, 6) &&
+                                            pi->sh->chip == BCMA_CHIP_ID_BCM47162) {
+                                                phy_a5 = 0x10f7 | (phy_a4 << 8);
+                                        } else if (NREV_GE(pi->pubpi.phy_rev, 6)) {
                                                phy_a5 = 0x00f7 | (phy_a4 << 8);
+                                        } else if (NREV_IS(pi->pubpi.phy_rev, 5)) {
-                                        else
-                                        if (NREV_IS(pi->pubpi.phy_rev, 5))
                                                phy_a5 = 0x10f7 | (phy_a4 << 8);
-                                        else
+                                        } else {
                                                phy_a5 = 0x50f7 | (phy_a4 << 8);
+                                        }
                                } else {
                                        phy_a5 = 0x70f7 | (phy_a4 << 8);
                                }
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/pmu.c b/drivers/net/wireless/brcm80211/brcmsmac/pmu.c
index 4931d29d077b..7e9df566c733 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/pmu.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/pmu.c
@@ -74,16 +74,6 @@
 * PMU<rev>_PLL<num>_XX where <rev> is PMU corerev and <num> is an arbitrary
 * number to differentiate different PLLs controlled by the same PMU rev.
 */
-/* pllcontrol registers:
- * ndiv_pwrdn, pwrdn_ch<x>, refcomp_pwrdn, dly_ch<x>,
- * p1div, p2div, _bypass_sdmod
- */
-#define PMU1_PLL0_PLLCTL0               0
-#define PMU1_PLL0_PLLCTL1               1
-#define PMU1_PLL0_PLLCTL2               2
-#define PMU1_PLL0_PLLCTL3               3
-#define PMU1_PLL0_PLLCTL4               4
-#define PMU1_PLL0_PLLCTL5               5
 /* pmu XtalFreqRatio */
 #define PMU_XTALFREQ_REG_ILPCTR_MASK    0x00001FFF
@@ -108,118 +98,14 @@
 #define RES4313_HT_AVAIL_RSRC           14
 #define RES4313_MACPHY_CLK_AVAIL_RSRC   15
-/* Determine min/max rsrc masks. Value 0 leaves hardware at default. */
-static void si_pmu_res_masks(struct si_pub *sih, u32 * pmin, u32 * pmax)
-{
-        u32 min_mask = 0, max_mask = 0;
-        uint rsrcs;
-        /* # resources */
-        rsrcs = (ai_get_pmucaps(sih) & PCAP_RC_MASK) >> PCAP_RC_SHIFT;
-        /* determine min/max rsrc masks */
-        switch (ai_get_chip_id(sih)) {
-        case BCM43224_CHIP_ID:
-        case BCM43225_CHIP_ID:
-                /* ??? */
-                break;
-        case BCM4313_CHIP_ID:
-                min_mask = PMURES_BIT(RES4313_BB_PU_RSRC) |
-                    PMURES_BIT(RES4313_XTAL_PU_RSRC) |
-                    PMURES_BIT(RES4313_ALP_AVAIL_RSRC) |
-                    PMURES_BIT(RES4313_BB_PLL_PWRSW_RSRC);
-                max_mask = 0xffff;
-                break;
-        default:
-                break;
-        }
-        *pmin = min_mask;
-        *pmax = max_mask;
-}
-void si_pmu_spuravoid_pllupdate(struct si_pub *sih, u8 spuravoid)
-{
-        u32 tmp = 0;
-        struct bcma_device *core;
-        /* switch to chipc */
-        core = ai_findcore(sih, BCMA_CORE_CHIPCOMMON, 0);
-        switch (ai_get_chip_id(sih)) {
-        case BCM43224_CHIP_ID:
-        case BCM43225_CHIP_ID:
-                if (spuravoid == 1) {
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_addr),
-                                     PMU1_PLL0_PLLCTL0);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_data),
-                                     0x11500010);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_addr),
-                                     PMU1_PLL0_PLLCTL1);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_data),
-                                     0x000C0C06);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_addr),
-                                     PMU1_PLL0_PLLCTL2);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_data),
-                                     0x0F600a08);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_addr),
-                                     PMU1_PLL0_PLLCTL3);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_data),
-                                     0x00000000);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_addr),
-                                     PMU1_PLL0_PLLCTL4);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_data),
-                                     0x2001E920);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_addr),
-                                     PMU1_PLL0_PLLCTL5);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_data),
-                                     0x88888815);
-                } else {
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_addr),
-                                     PMU1_PLL0_PLLCTL0);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_data),
-                                     0x11100010);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_addr),
-                                     PMU1_PLL0_PLLCTL1);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_data),
-                                     0x000c0c06);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_addr),
-                                     PMU1_PLL0_PLLCTL2);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_data),
-                                     0x03000a08);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_addr),
-                                     PMU1_PLL0_PLLCTL3);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_data),
-                                     0x00000000);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_addr),
-                                     PMU1_PLL0_PLLCTL4);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_data),
-                                     0x200005c0);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_addr),
-                                     PMU1_PLL0_PLLCTL5);
-                        bcma_write32(core, CHIPCREGOFFS(pllcontrol_data),
-                                     0x88888815);
-                }
-                tmp = 1 << 10;
-                break;
-        default:
-                /* bail out */
-                return;
-        }
-        bcma_set32(core, CHIPCREGOFFS(pmucontrol), tmp);
-}
 u16 si_pmu_fast_pwrup_delay(struct si_pub *sih)
 {
        uint delay = PMU_MAX_TRANSITION_DLY;
        switch (ai_get_chip_id(sih)) {
-        case BCM43224_CHIP_ID:
+        case BCMA_CHIP_ID_BCM43224:
-        case BCM43225_CHIP_ID:
+        case BCMA_CHIP_ID_BCM43225:
-        case BCM4313_CHIP_ID:
+        case BCMA_CHIP_ID_BCM4313:
                delay = 3700;
                break;
        default:
@@ -270,9 +156,9 @@ u32 si_pmu_alp_clock(struct si_pub *sih)
                return clock;
        switch (ai_get_chip_id(sih)) {
-        case BCM43224_CHIP_ID:
+        case BCMA_CHIP_ID_BCM43224:
-        case BCM43225_CHIP_ID:
+        case BCMA_CHIP_ID_BCM43225:
-        case BCM4313_CHIP_ID:
+        case BCMA_CHIP_ID_BCM4313:
                /* always 20Mhz */
                clock = 20000 * 1000;
                break;
@@ -283,51 +169,9 @@ u32 si_pmu_alp_clock(struct si_pub *sih)
        return clock;
 }
-/* initialize PMU */
-void si_pmu_init(struct si_pub *sih)
-{
-        struct bcma_device *core;
-        /* select chipc */
-        core = ai_findcore(sih, BCMA_CORE_CHIPCOMMON, 0);
-        if (ai_get_pmurev(sih) == 1)
-                bcma_mask32(core, CHIPCREGOFFS(pmucontrol),
-                            ~PCTL_NOILP_ON_WAIT);
-        else if (ai_get_pmurev(sih) >= 2)
-                bcma_set32(core, CHIPCREGOFFS(pmucontrol), PCTL_NOILP_ON_WAIT);
-}
-/* initialize PMU resources */
-void si_pmu_res_init(struct si_pub *sih)
-{
-        struct bcma_device *core;
-        u32 min_mask = 0, max_mask = 0;
-        /* select to chipc */
-        core = ai_findcore(sih, BCMA_CORE_CHIPCOMMON, 0);
-        /* Determine min/max rsrc masks */
-        si_pmu_res_masks(sih, &min_mask, &max_mask);
-        /* It is required to program max_mask first and then min_mask */
-        /* Program max resource mask */
-        if (max_mask)
-                bcma_write32(core, CHIPCREGOFFS(max_res_mask), max_mask);
-        /* Program min resource mask */
-        if (min_mask)
-                bcma_write32(core, CHIPCREGOFFS(min_res_mask), min_mask);
-        /* Add some delay; allow resources to come up and settle. */
-        mdelay(2);
-}
 u32 si_pmu_measure_alpclk(struct si_pub *sih)
 {
+        struct si_info *sii = container_of(sih, struct si_info, pub);
        struct bcma_device *core;
        u32 alp_khz;
@@ -335,7 +179,7 @@ u32 si_pmu_measure_alpclk(struct si_pub *sih)
                return 0;
        /* Remember original core before switch to chipc */
-        core = ai_findcore(sih, BCMA_CORE_CHIPCOMMON, 0);
+        core = sii->icbus->drv_cc.core;
        if (bcma_read32(core, CHIPCREGOFFS(pmustatus)) & PST_EXTLPOAVAIL) {
                u32 ilp_ctr, alp_hz;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/pmu.h b/drivers/net/wireless/brcm80211/brcmsmac/pmu.h
index 3e39c5e0f9ff..f7cff873578b 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/pmu.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/pmu.h
@@ -26,10 +26,7 @@ extern u32 si_pmu_chipcontrol(struct si_pub *sih, uint reg, u32 mask, u32 val);
 extern u32 si_pmu_regcontrol(struct si_pub *sih, uint reg, u32 mask, u32 val);
 extern u32 si_pmu_alp_clock(struct si_pub *sih);
 extern void si_pmu_pllupd(struct si_pub *sih);
-extern void si_pmu_spuravoid_pllupdate(struct si_pub *sih, u8 spuravoid);
 extern u32 si_pmu_pllcontrol(struct si_pub *sih, uint reg, u32 mask, u32 val);
-extern void si_pmu_init(struct si_pub *sih);
-extern void si_pmu_res_init(struct si_pub *sih);
 extern u32 si_pmu_measure_alpclk(struct si_pub *sih);
 #endif /* _BRCM_PMU_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/pub.h b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
index aa5d67f8d874..5855f4fd16dc 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
@@ -311,7 +311,7 @@ extern uint brcms_c_detach(struct brcms_c_info *wlc);
 extern int brcms_c_up(struct brcms_c_info *wlc);
 extern uint brcms_c_down(struct brcms_c_info *wlc);
-extern bool brcms_c_chipmatch(u16 vendor, u16 device);
+extern bool brcms_c_chipmatch(struct bcma_device *core);
 extern void brcms_c_init(struct brcms_c_info *wlc, bool mute_tx);
 extern void brcms_c_reset(struct brcms_c_info *wlc);
diff --git a/drivers/net/wireless/brcm80211/include/soc.h b/drivers/net/wireless/brcm80211/include/soc.h
index 4e9b7e4827ea..123cfa854a0d 100644
--- a/drivers/net/wireless/brcm80211/include/soc.h
+++ b/drivers/net/wireless/brcm80211/include/soc.h
@@ -19,68 +19,6 @@
 #define SI_ENUM_BASE            0x18000000      /* Enumeration space base */
-/* core codes */
-#define NODEV_CORE_ID           0x700   /* Invalid coreid */
-#define CC_CORE_ID              0x800   /* chipcommon core */
-#define ILINE20_CORE_ID         0x801   /* iline20 core */
-#define SRAM_CORE_ID            0x802   /* sram core */
-#define SDRAM_CORE_ID           0x803   /* sdram core */
-#define PCI_CORE_ID             0x804   /* pci core */
-#define MIPS_CORE_ID            0x805   /* mips core */
-#define ENET_CORE_ID            0x806   /* enet mac core */
-#define CODEC_CORE_ID           0x807   /* v90 codec core */
-#define USB_CORE_ID             0x808   /* usb 1.1 host/device core */
-#define ADSL_CORE_ID            0x809   /* ADSL core */
-#define ILINE100_CORE_ID        0x80a   /* iline100 core */
-#define IPSEC_CORE_ID           0x80b   /* ipsec core */
-#define UTOPIA_CORE_ID          0x80c   /* utopia core */
-#define PCMCIA_CORE_ID          0x80d   /* pcmcia core */
-#define SOCRAM_CORE_ID          0x80e   /* internal memory core */
-#define MEMC_CORE_ID            0x80f   /* memc sdram core */
-#define OFDM_CORE_ID            0x810   /* OFDM phy core */
-#define EXTIF_CORE_ID           0x811   /* external interface core */
-#define D11_CORE_ID             0x812   /* 802.11 MAC core */
-#define APHY_CORE_ID            0x813   /* 802.11a phy core */
-#define BPHY_CORE_ID            0x814   /* 802.11b phy core */
-#define GPHY_CORE_ID            0x815   /* 802.11g phy core */
-#define MIPS33_CORE_ID          0x816   /* mips3302 core */
-#define USB11H_CORE_ID          0x817   /* usb 1.1 host core */
-#define USB11D_CORE_ID          0x818   /* usb 1.1 device core */
-#define USB20H_CORE_ID          0x819   /* usb 2.0 host core */
-#define USB20D_CORE_ID          0x81a   /* usb 2.0 device core */
-#define SDIOH_CORE_ID           0x81b   /* sdio host core */
-#define ROBO_CORE_ID            0x81c   /* roboswitch core */
-#define ATA100_CORE_ID          0x81d   /* parallel ATA core */
-#define SATAXOR_CORE_ID         0x81e   /* serial ATA & XOR DMA core */
-#define GIGETH_CORE_ID          0x81f   /* gigabit ethernet core */
-#define PCIE_CORE_ID            0x820   /* pci express core */
-#define NPHY_CORE_ID            0x821   /* 802.11n 2x2 phy core */
-#define SRAMC_CORE_ID           0x822   /* SRAM controller core */
-#define MINIMAC_CORE_ID         0x823   /* MINI MAC/phy core */
-#define ARM11_CORE_ID           0x824   /* ARM 1176 core */
-#define ARM7S_CORE_ID           0x825   /* ARM7tdmi-s core */
-#define LPPHY_CORE_ID           0x826   /* 802.11a/b/g phy core */
-#define PMU_CORE_ID             0x827   /* PMU core */
-#define SSNPHY_CORE_ID          0x828   /* 802.11n single-stream phy core */
-#define SDIOD_CORE_ID           0x829   /* SDIO device core */
-#define ARMCM3_CORE_ID          0x82a   /* ARM Cortex M3 core */
-#define HTPHY_CORE_ID           0x82b   /* 802.11n 4x4 phy core */
-#define MIPS74K_CORE_ID         0x82c   /* mips 74k core */
-#define GMAC_CORE_ID            0x82d   /* Gigabit MAC core */
-#define DMEMC_CORE_ID           0x82e   /* DDR1/2 memory controller core */
-#define PCIERC_CORE_ID          0x82f   /* PCIE Root Complex core */
-#define OCP_CORE_ID             0x830   /* OCP2OCP bridge core */
-#define SC_CORE_ID              0x831   /* shared common core */
-#define AHB_CORE_ID             0x832   /* OCP2AHB bridge core */
-#define SPIH_CORE_ID            0x833   /* SPI host core */
-#define I2S_CORE_ID             0x834   /* I2S core */
-#define DMEMS_CORE_ID           0x835   /* SDR/DDR1 memory controller core */
-#define DEF_SHIM_COMP           0x837   /* SHIM component in ubus/6362 */
-#define OOB_ROUTER_CORE_ID      0x367   /* OOB router core ID */
-#define DEF_AI_COMP             0xfff   /* Default component, in ai chips it
-                                         * maps all unused address ranges
-                                         */
 /* Common core control flags */
 #define SICF_BIST_EN            0x8000
 #define SICF_PME_EN             0x4000
diff --git a/drivers/net/wireless/iwlegacy/3945-rs.c b/drivers/net/wireless/iwlegacy/3945-rs.c
index 4b10157d8686..d4fd29ad90dc 100644
--- a/drivers/net/wireless/iwlegacy/3945-rs.c
+++ b/drivers/net/wireless/iwlegacy/3945-rs.c
@@ -946,7 +946,7 @@ il3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id)
        case IEEE80211_BAND_5GHZ:
                rs_sta->expected_tpt = il3945_expected_tpt_a;
                break;
-        case IEEE80211_NUM_BANDS:
+        default:
                BUG();
                break;
        }
diff --git a/drivers/net/wireless/iwlwifi/dvm/commands.h b/drivers/net/wireless/iwlwifi/dvm/commands.h
index 64811cd91635..97bea16f3592 100644
--- a/drivers/net/wireless/iwlwifi/dvm/commands.h
+++ b/drivers/net/wireless/iwlwifi/dvm/commands.h
@@ -190,6 +190,44 @@ enum {
        REPLY_MAX = 0xff
 };
+/*
+ * Minimum number of queues. MAX_NUM is defined in hw specific files.
+ * Set the minimum to accommodate
+ *  - 4 standard TX queues
+ *  - the command queue
+ *  - 4 PAN TX queues
+ *  - the PAN multicast queue, and
+ *  - the AUX (TX during scan dwell) queue.
+ */
+#define IWL_MIN_NUM_QUEUES      11
+/*
+ * Command queue depends on iPAN support.
+ */
+#define IWL_DEFAULT_CMD_QUEUE_NUM       4
+#define IWL_IPAN_CMD_QUEUE_NUM          9
+#define IWL_TX_FIFO_BK          0       /* shared */
+#define IWL_TX_FIFO_BE          1
+#define IWL_TX_FIFO_VI          2       /* shared */
+#define IWL_TX_FIFO_VO          3
+#define IWL_TX_FIFO_BK_IPAN     IWL_TX_FIFO_BK
+#define IWL_TX_FIFO_BE_IPAN     4
+#define IWL_TX_FIFO_VI_IPAN     IWL_TX_FIFO_VI
+#define IWL_TX_FIFO_VO_IPAN     5
+/* re-uses the VO FIFO, uCode will properly flush/schedule */
+#define IWL_TX_FIFO_AUX         5
+#define IWL_TX_FIFO_UNUSED      255
+#define IWLAGN_CMD_FIFO_NUM     7
+/*
+ * This queue number is required for proper operation
+ * because the ucode will stop/start the scheduler as
+ * required.
+ */
+#define IWL_IPAN_MCAST_QUEUE    8
 /******************************************************************************
 * (0)
 * Commonly used structures and definitions:
@@ -755,8 +793,6 @@ struct iwl_qosparam_cmd {
 #define IWLAGN_BROADCAST_ID     15
 #define IWLAGN_STATION_COUNT    16
-#define IWL_INVALID_STATION     255
-#define IWL_MAX_TID_COUNT       8
 #define IWL_TID_NON_QOS IWL_MAX_TID_COUNT
 #define STA_FLG_TX_RATE_MSK             cpu_to_le32(1 << 2)
diff --git a/drivers/net/wireless/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
index b0eff1c340c7..46782f1102ac 100644
--- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
@@ -83,7 +83,7 @@ static ssize_t iwl_dbgfs_##name##_write(struct file *file,              \
 #define DEBUGFS_READ_FILE_OPS(name)                                     \
        DEBUGFS_READ_FUNC(name);                                        \
 static const struct file_operations iwl_dbgfs_##name##_ops = {          \
-        .read = iwl_dbgfs_##name##_read,                                \
+        .read = iwl_dbgfs_##name##_read,                                \
        .open = simple_open,                                            \
        .llseek = generic_file_llseek,                                  \
 };
@@ -2255,6 +2255,10 @@ static ssize_t iwl_dbgfs_log_event_write(struct file *file,
        char buf[8];
        int buf_size;
+        /* check that the interface is up */
+        if (!iwl_is_ready(priv))
+                return -EAGAIN;
        memset(buf, 0, sizeof(buf));
        buf_size = min(count, sizeof(buf) -  1);
        if (copy_from_user(buf, user_buf, buf_size))
diff --git a/drivers/net/wireless/iwlwifi/dvm/dev.h b/drivers/net/wireless/iwlwifi/dvm/dev.h
index 54cf085ddc89..054f728f6266 100644
--- a/drivers/net/wireless/iwlwifi/dvm/dev.h
+++ b/drivers/net/wireless/iwlwifi/dvm/dev.h
@@ -90,22 +90,6 @@
 #define IWL_NUM_SCAN_RATES         (2)
-/*
- * Minimum number of queues. MAX_NUM is defined in hw specific files.
- * Set the minimum to accommodate
- *  - 4 standard TX queues
- *  - the command queue
- *  - 4 PAN TX queues
- *  - the PAN multicast queue, and
- *  - the AUX (TX during scan dwell) queue.
- */
-#define IWL_MIN_NUM_QUEUES      11
-/*
- * Command queue depends on iPAN support.
- */
-#define IWL_DEFAULT_CMD_QUEUE_NUM       4
-#define IWL_IPAN_CMD_QUEUE_NUM          9
 #define IEEE80211_DATA_LEN              2304
 #define IEEE80211_4ADDR_LEN             30
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index abfd7916bde6..612f05d757db 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -518,49 +518,6 @@ static void iwl_bg_tx_flush(struct work_struct *work)
 * queue/FIFO/AC mapping definitions
 */
-#define IWL_TX_FIFO_BK          0       /* shared */
-#define IWL_TX_FIFO_BE          1
-#define IWL_TX_FIFO_VI          2       /* shared */
-#define IWL_TX_FIFO_VO          3
-#define IWL_TX_FIFO_BK_IPAN     IWL_TX_FIFO_BK
-#define IWL_TX_FIFO_BE_IPAN     4
-#define IWL_TX_FIFO_VI_IPAN     IWL_TX_FIFO_VI
-#define IWL_TX_FIFO_VO_IPAN     5
-/* re-uses the VO FIFO, uCode will properly flush/schedule */
-#define IWL_TX_FIFO_AUX         5
-#define IWL_TX_FIFO_UNUSED      -1
-#define IWLAGN_CMD_FIFO_NUM     7
-/*
- * This queue number is required for proper operation
- * because the ucode will stop/start the scheduler as
- * required.
- */
-#define IWL_IPAN_MCAST_QUEUE    8
-static const u8 iwlagn_default_queue_to_tx_fifo[] = {
-        IWL_TX_FIFO_VO,
-        IWL_TX_FIFO_VI,
-        IWL_TX_FIFO_BE,
-        IWL_TX_FIFO_BK,
-        IWLAGN_CMD_FIFO_NUM,
-};
-static const u8 iwlagn_ipan_queue_to_tx_fifo[] = {
-        IWL_TX_FIFO_VO,
-        IWL_TX_FIFO_VI,
-        IWL_TX_FIFO_BE,
-        IWL_TX_FIFO_BK,
-        IWL_TX_FIFO_BK_IPAN,
-        IWL_TX_FIFO_BE_IPAN,
-        IWL_TX_FIFO_VI_IPAN,
-        IWL_TX_FIFO_VO_IPAN,
-        IWL_TX_FIFO_BE_IPAN,
-        IWLAGN_CMD_FIFO_NUM,
-        IWL_TX_FIFO_AUX,
-};
 static const u8 iwlagn_bss_ac_to_fifo[] = {
        IWL_TX_FIFO_VO,
        IWL_TX_FIFO_VI,
@@ -1350,6 +1307,7 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
        else
                trans_cfg.queue_watchdog_timeout = IWL_WATCHDOG_DISABLED;
        trans_cfg.command_names = iwl_dvm_cmd_strings;
+        trans_cfg.cmd_fifo = IWLAGN_CMD_FIFO_NUM;
        WARN_ON(sizeof(priv->transport_queue_stop) * BITS_PER_BYTE <
                priv->cfg->base_params->num_of_queues);
@@ -1363,15 +1321,9 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
        if (ucode_flags & IWL_UCODE_TLV_FLAGS_PAN) {
                priv->sta_key_max_num = STA_KEY_MAX_NUM_PAN;
                trans_cfg.cmd_queue = IWL_IPAN_CMD_QUEUE_NUM;
-                trans_cfg.queue_to_fifo = iwlagn_ipan_queue_to_tx_fifo;
-                trans_cfg.n_queue_to_fifo =
-                        ARRAY_SIZE(iwlagn_ipan_queue_to_tx_fifo);
        } else {
                priv->sta_key_max_num = STA_KEY_MAX_NUM;
                trans_cfg.cmd_queue = IWL_DEFAULT_CMD_QUEUE_NUM;
-                trans_cfg.queue_to_fifo = iwlagn_default_queue_to_tx_fifo;
-                trans_cfg.n_queue_to_fifo =
-                        ARRAY_SIZE(iwlagn_default_queue_to_tx_fifo);
        }
        /* Configure transport layer */
@@ -1460,9 +1412,6 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
                ucode_flags &= ~IWL_UCODE_TLV_FLAGS_P2P;
                priv->sta_key_max_num = STA_KEY_MAX_NUM;
                trans_cfg.cmd_queue = IWL_DEFAULT_CMD_QUEUE_NUM;
-                trans_cfg.queue_to_fifo = iwlagn_default_queue_to_tx_fifo;
-                trans_cfg.n_queue_to_fifo =
-                        ARRAY_SIZE(iwlagn_default_queue_to_tx_fifo);
                /* Configure transport layer again*/
                iwl_trans_configure(priv->trans, &trans_cfg);
@@ -1480,9 +1429,6 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
                atomic_set(&priv->queue_stop_count[i], 0);
        }
-        WARN_ON(trans_cfg.queue_to_fifo[trans_cfg.cmd_queue] !=
-                                                IWLAGN_CMD_FIFO_NUM);
        if (iwl_init_drv(priv))
                goto out_free_eeprom;
diff --git a/drivers/net/wireless/iwlwifi/dvm/scan.c b/drivers/net/wireless/iwlwifi/dvm/scan.c
index 6633074258c7..e3467fa86899 100644
--- a/drivers/net/wireless/iwlwifi/dvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/dvm/scan.c
@@ -396,15 +396,21 @@ static u16 iwl_get_active_dwell_time(struct iwl_priv *priv,
 static u16 iwl_limit_dwell(struct iwl_priv *priv, u16 dwell_time)
 {
        struct iwl_rxon_context *ctx;
+        int limits[NUM_IWL_RXON_CTX] = {};
+        int n_active = 0;
+        u16 limit;
+        BUILD_BUG_ON(NUM_IWL_RXON_CTX != 2);
        /*
         * If we're associated, we clamp the dwell time 98%
-         * of the smallest beacon interval (minus 2 * channel
+         * of the beacon interval (minus 2 * channel tune time)
-         * tune time)
+         * If both contexts are active, we have to restrict to
+         * 1/2 of the minimum of them, because they might be in
+         * lock-step with the time inbetween only half of what
+         * time we'd have in each of them.
         */
        for_each_context(priv, ctx) {
-                u16 value;
                switch (ctx->staging.dev_type) {
                case RXON_DEV_TYPE_P2P:
                        /* no timing constraints */
@@ -424,14 +430,25 @@ static u16 iwl_limit_dwell(struct iwl_priv *priv, u16 dwell_time)
                        break;
                }
-                value = ctx->beacon_int;
+                limits[n_active++] = ctx->beacon_int ?: IWL_PASSIVE_DWELL_BASE;
-                if (!value)
-                        value = IWL_PASSIVE_DWELL_BASE;
-                value = (value * 98) / 100 - IWL_CHANNEL_TUNE_TIME * 2;
-                dwell_time = min(value, dwell_time);
        }
-        return dwell_time;
+        switch (n_active) {
+        case 0:
+                return dwell_time;
+        case 2:
+                limit = (limits[1] * 98) / 100 - IWL_CHANNEL_TUNE_TIME * 2;
+                limit /= 2;
+                dwell_time = min(limit, dwell_time);
+                /* fall through to limit further */
+        case 1:
+                limit = (limits[0] * 98) / 100 - IWL_CHANNEL_TUNE_TIME * 2;
+                limit /= n_active;
+                return min(limit, dwell_time);
+        default:
+                WARN_ON_ONCE(1);
+                return dwell_time;
+        }
 }
 static u16 iwl_get_passive_dwell_time(struct iwl_priv *priv,
diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
index b3a314ba48c7..6d8d6dd7943f 100644
--- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
@@ -226,13 +226,50 @@ int iwl_send_bt_env(struct iwl_priv *priv, u8 action, u8 type)
        return ret;
 }
+static const u8 iwlagn_default_queue_to_tx_fifo[] = {
+        IWL_TX_FIFO_VO,
+        IWL_TX_FIFO_VI,
+        IWL_TX_FIFO_BE,
+        IWL_TX_FIFO_BK,
+};
+static const u8 iwlagn_ipan_queue_to_tx_fifo[] = {
+        IWL_TX_FIFO_VO,
+        IWL_TX_FIFO_VI,
+        IWL_TX_FIFO_BE,
+        IWL_TX_FIFO_BK,
+        IWL_TX_FIFO_BK_IPAN,
+        IWL_TX_FIFO_BE_IPAN,
+        IWL_TX_FIFO_VI_IPAN,
+        IWL_TX_FIFO_VO_IPAN,
+        IWL_TX_FIFO_BE_IPAN,
+        IWL_TX_FIFO_UNUSED,
+        IWL_TX_FIFO_AUX,
+};
 static int iwl_alive_notify(struct iwl_priv *priv)
 {
+        const u8 *queue_to_txf;
+        u8 n_queues;
        int ret;
+        int i;
        iwl_trans_fw_alive(priv->trans);
+        if (priv->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_PAN &&
+            priv->eeprom_data->sku & EEPROM_SKU_CAP_IPAN_ENABLE) {
+                n_queues = ARRAY_SIZE(iwlagn_ipan_queue_to_tx_fifo);
+                queue_to_txf = iwlagn_ipan_queue_to_tx_fifo;
+        } else {
+                n_queues = ARRAY_SIZE(iwlagn_default_queue_to_tx_fifo);
+                queue_to_txf = iwlagn_default_queue_to_tx_fifo;
+        }
+        for (i = 0; i < n_queues; i++)
+                if (queue_to_txf[i] != IWL_TX_FIFO_UNUSED)
+                        iwl_trans_ac_txq_enable(priv->trans, i,
+                                                queue_to_txf[i]);
        priv->passive_no_rx = false;
        priv->transport_queue_stop = 0;
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.c b/drivers/net/wireless/iwlwifi/iwl-debug.c
index 0f8fcd1d4fe2..87535a67de76 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.c
@@ -61,6 +61,9 @@
 *
 *****************************************************************************/
+#define DEBUG
+#include <linux/device.h>
 #include <linux/interrupt.h>
 #include <linux/export.h>
 #include "iwl-debug.h"
@@ -124,7 +127,7 @@ void __iwl_dbg(struct device *dev,
 #ifdef CONFIG_IWLWIFI_DEBUG
        if (iwl_have_debug_level(level) &&
            (!limit || net_ratelimit()))
-                dev_err(dev, "%c %s %pV", in_interrupt() ? 'I' : 'U',
+                dev_dbg(dev, "%c %s %pV", in_interrupt() ? 'I' : 'U',
                        function, &vaf);
 #endif
        trace_iwlwifi_dbg(level, in_interrupt(), function, &vaf);
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.h b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
index 65364793021f..06ca505bb2cc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.h
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
@@ -176,7 +176,7 @@ TRACE_EVENT(iwlwifi_dev_ucode_wrap_event,
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM iwlwifi_msg
-#define MAX_MSG_LEN     100
+#define MAX_MSG_LEN     110
 DECLARE_EVENT_CLASS(iwlwifi_msg_event,
        TP_PROTO(struct va_format *vaf),
@@ -189,7 +189,7 @@ DECLARE_EVENT_CLASS(iwlwifi_msg_event,
                                       MAX_MSG_LEN, vaf->fmt,
                                       *vaf->va) >= MAX_MSG_LEN);
        ),
-        TP_printk("%s", (char *)__get_dynamic_array(msg))
+        TP_printk("%s", __get_str(msg))
 );
 DEFINE_EVENT(iwlwifi_msg_event, iwlwifi_err,
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index a175997e7829..cc41cfaedfbd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -1013,6 +1013,7 @@ struct iwl_mod_params iwlwifi_mod_params = {
        .power_level = IWL_POWER_INDEX_1,
        .bt_ch_announce = true,
        .auto_agg = true,
+        .wd_disable = true,
        /* the rest are 0 by default */
 };
 EXPORT_SYMBOL_GPL(iwlwifi_mod_params);
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 00efde8e5536..867d8e194da4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -290,16 +290,17 @@ static inline struct page *rxb_steal_page(struct iwl_rx_cmd_buffer *r)
 * currently supports
 */
 #define IWL_MAX_HW_QUEUES               32
+#define IWL_INVALID_STATION     255
+#define IWL_MAX_TID_COUNT       8
+#define IWL_FRAME_LIMIT 64
 /**
 * struct iwl_trans_config - transport configuration
 *
 * @op_mode: pointer to the upper layer.
- * @queue_to_fifo: queue to FIFO mapping to set up by
- *      default
- * @n_queue_to_fifo: number of queues to set up
 * @cmd_queue: the index of the command queue.
 *      Must be set before start_fw.
+ * @cmd_fifo: the fifo for host commands
 * @no_reclaim_cmds: Some devices erroneously don't set the
 *      SEQ_RX_FRAME bit on some notifications, this is the
 *      list of such notifications to filter. Max length is
@@ -314,10 +315,9 @@ static inline struct page *rxb_steal_page(struct iwl_rx_cmd_buffer *r)
 */
 struct iwl_trans_config {
        struct iwl_op_mode *op_mode;
-        const u8 *queue_to_fifo;
-        u8 n_queue_to_fifo;
        u8 cmd_queue;
+        u8 cmd_fifo;
        const u8 *no_reclaim_cmds;
        int n_no_reclaim_cmds;
@@ -355,9 +355,9 @@ struct iwl_trans;
 *      Must be atomic
 * @reclaim: free packet until ssn. Returns a list of freed packets.
 *      Must be atomic
- * @txq_enable: setup a tx queue for AMPDU - will be called once the HW is
+ * @txq_enable: setup a queue. To setup an AC queue, use the
- *      ready and a successful ADDBA response has been received.
+ *      iwl_trans_ac_txq_enable wrapper. fw_alive must have been called before
- *      May sleep
+ *      this one. The op_mode must not configure the HCMD queue. May sleep.
 * @txq_disable: de-configure a Tx queue to send AMPDUs
 *      Must be atomic
 * @wait_tx_queue_empty: wait until all tx queues are empty
@@ -497,9 +497,9 @@ static inline void iwl_trans_fw_alive(struct iwl_trans *trans)
 {
        might_sleep();
-        trans->ops->fw_alive(trans);
        trans->state = IWL_TRANS_FW_ALIVE;
+        trans->ops->fw_alive(trans);
 }
 static inline int iwl_trans_start_fw(struct iwl_trans *trans,
@@ -593,6 +593,13 @@ static inline void iwl_trans_txq_enable(struct iwl_trans *trans, int queue,
                                 frame_limit, ssn);
 }
+static inline void iwl_trans_ac_txq_enable(struct iwl_trans *trans, int queue,
+                                           int fifo)
+{
+        iwl_trans_txq_enable(trans, queue, fifo, IWL_INVALID_STATION,
+                             IWL_MAX_TID_COUNT, IWL_FRAME_LIMIT, 0);
+}
 static inline int iwl_trans_wait_tx_queue_empty(struct iwl_trans *trans)
 {
        WARN_ONCE(trans->state != IWL_TRANS_FW_ALIVE,
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index 5024fb662bf6..d9694c58208c 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -269,10 +269,9 @@ struct iwl_trans_pcie {
        wait_queue_head_t ucode_write_waitq;
        unsigned long status;
        u8 cmd_queue;
+        u8 cmd_fifo;
        u8 n_no_reclaim_cmds;
        u8 no_reclaim_cmds[MAX_NO_RECLAIM_CMDS];
-        u8 setup_q_to_fifo[IWL_MAX_HW_QUEUES];
-        u8 n_q_to_fifo;
        bool rx_buf_size_8k;
        u32 rx_page_order;
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index be143eb4aa4f..39a6ca1f009c 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -879,9 +879,6 @@ static irqreturn_t iwl_isr(int irq, void *data)
        lockdep_assert_held(&trans_pcie->irq_lock);
-        if (!trans)
-                return IRQ_NONE;
        trace_iwlwifi_dev_irq(trans->dev);
        /* Disable (but don't clear!) interrupts here to avoid
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index d1950838f17f..09795afccb23 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1059,7 +1059,7 @@ static void iwl_tx_start(struct iwl_trans *trans)
 {
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
        u32 a;
-        int i, chan;
+        int chan;
        u32 reg_val;
        /* make sure all queue are not stopped/used */
@@ -1091,12 +1091,8 @@ static void iwl_tx_start(struct iwl_trans *trans)
         */
        iwl_write_prph(trans, SCD_CHAINEXT_EN, 0);
-        for (i = 0; i < trans_pcie->n_q_to_fifo; i++) {
+        iwl_trans_ac_txq_enable(trans, trans_pcie->cmd_queue,
-                int fifo = trans_pcie->setup_q_to_fifo[i];
+                                trans_pcie->cmd_fifo);
-                iwl_trans_pcie_txq_enable(trans, i, fifo, IWL_INVALID_STATION,
-                                          IWL_TID_NON_QOS, SCD_FRAME_LIMIT, 0);
-        }
        /* Activate all Tx DMA/FIFO channels */
        iwl_trans_txq_set_sched(trans, IWL_MASK(0, 7));
@@ -1145,7 +1141,7 @@ static int iwl_trans_tx_stop(struct iwl_trans *trans)
                        FH_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(ch), 1000);
                if (ret < 0)
                        IWL_ERR(trans,
-                                "Failing on timeout while stopping DMA channel %d [0x%08x]",
+                                "Failing on timeout while stopping DMA channel %d [0x%08x]\n",
                                ch,
                                iwl_read_direct32(trans,
                                                  FH_TSSR_TX_STATUS_REG));
@@ -1153,7 +1149,8 @@ static int iwl_trans_tx_stop(struct iwl_trans *trans)
        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
        if (!trans_pcie->txq) {
-                IWL_WARN(trans, "Stopping tx queues that aren't allocated...");
+                IWL_WARN(trans,
+                         "Stopping tx queues that aren't allocated...\n");
                return 0;
        }
@@ -1430,7 +1427,7 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
        err = iwl_prepare_card_hw(trans);
        if (err) {
-                IWL_ERR(trans, "Error while preparing HW: %d", err);
+                IWL_ERR(trans, "Error while preparing HW: %d\n", err);
                goto err_free_irq;
        }
@@ -1528,6 +1525,7 @@ static void iwl_trans_pcie_configure(struct iwl_trans *trans,
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
        trans_pcie->cmd_queue = trans_cfg->cmd_queue;
+        trans_pcie->cmd_fifo = trans_cfg->cmd_fifo;
        if (WARN_ON(trans_cfg->n_no_reclaim_cmds > MAX_NO_RECLAIM_CMDS))
                trans_pcie->n_no_reclaim_cmds = 0;
        else
@@ -1536,17 +1534,6 @@ static void iwl_trans_pcie_configure(struct iwl_trans *trans,
                memcpy(trans_pcie->no_reclaim_cmds, trans_cfg->no_reclaim_cmds,
                       trans_pcie->n_no_reclaim_cmds * sizeof(u8));
-        trans_pcie->n_q_to_fifo = trans_cfg->n_queue_to_fifo;
-        if (WARN_ON(trans_pcie->n_q_to_fifo > IWL_MAX_HW_QUEUES))
-                trans_pcie->n_q_to_fifo = IWL_MAX_HW_QUEUES;
-        /* at least the command queue must be mapped */
-        WARN_ON(!trans_pcie->n_q_to_fifo);
-        memcpy(trans_pcie->setup_q_to_fifo, trans_cfg->queue_to_fifo,
-               trans_pcie->n_q_to_fifo * sizeof(u8));
        trans_pcie->rx_buf_size_8k = trans_cfg->rx_buf_size_8k;
        if (trans_pcie->rx_buf_size_8k)
                trans_pcie->rx_page_order = get_order(8 * 1024);
@@ -2141,13 +2128,14 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
        err = pci_request_regions(pdev, DRV_NAME);
        if (err) {
-                dev_printk(KERN_ERR, &pdev->dev, "pci_request_regions failed");
+                dev_printk(KERN_ERR, &pdev->dev,
+                           "pci_request_regions failed\n");
                goto out_pci_disable_device;
        }
        trans_pcie->hw_base = pci_ioremap_bar(pdev, 0);
        if (!trans_pcie->hw_base) {
-                dev_printk(KERN_ERR, &pdev->dev, "pci_ioremap_bar failed");
+                dev_printk(KERN_ERR, &pdev->dev, "pci_ioremap_bar failed\n");
                err = -ENODEV;
                goto out_pci_release_regions;
        }
@@ -2168,7 +2156,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
        err = pci_enable_msi(pdev);
        if (err)
                dev_printk(KERN_ERR, &pdev->dev,
-                           "pci_enable_msi failed(0X%x)", err);
+                           "pci_enable_msi failed(0X%x)\n", err);
        trans->dev = &pdev->dev;
        trans_pcie->irq = pdev->irq;
diff --git a/drivers/net/wireless/iwmc3200wifi/Kconfig b/drivers/net/wireless/iwmc3200wifi/Kconfig
deleted file mode 100644
index 7107ce53d4d4..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/Kconfig
+++ /dev/null
@@ -1,39 +0,0 @@
-config IWM
-        tristate "Intel Wireless Multicomm 3200 WiFi driver (EXPERIMENTAL)"
-        depends on MMC && EXPERIMENTAL
-        depends on CFG80211
-        select FW_LOADER
-        select IWMC3200TOP
-        help
-          The Intel Wireless Multicomm 3200 hardware is a combo
-          card with GPS, Bluetooth, WiMax and 802.11 radios. It
-          runs over SDIO and is typically found on Moorestown
-          based platform. This driver takes care of the 802.11
-          part, which is a fullmac one.
-          If you choose to build it as a module, it'll be called
-          iwmc3200wifi.ko.
-config IWM_DEBUG
-        bool "Enable full debugging output in iwmc3200wifi"
-        depends on IWM && DEBUG_FS
-        help
-          This option will enable debug tracing and setting for iwm
-          You can set the debug level and module through debugfs. By
-          default all modules are set to the IWL_DL_ERR level.
-          To see the list of debug modules and levels, see iwm/debug.h
-          For example, if you want the full MLME debug output:
-          echo 0xff > /sys/kernel/debug/iwm/phyN/debug/mlme
-          Or, if you want the full debug, for all modules:
-          echo 0xff > /sys/kernel/debug/iwm/phyN/debug/level
-          echo 0xff > /sys/kernel/debug/iwm/phyN/debug/modules
-config IWM_TRACING
-        bool "Enable event tracing for iwmc3200wifi"
-        depends on IWM && EVENT_TRACING
-        help
-          Say Y here to trace all the commands and responses between
-          the driver and firmware (including TX/RX frames) with ftrace.
diff --git a/drivers/net/wireless/iwmc3200wifi/Makefile b/drivers/net/wireless/iwmc3200wifi/Makefile
deleted file mode 100644
index cdc7e07ba113..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/Makefile
+++ /dev/null
@@ -1,10 +0,0 @@
-obj-$(CONFIG_IWM) := iwmc3200wifi.o
-iwmc3200wifi-objs += main.o netdev.o rx.o tx.o sdio.o hal.o fw.o
-iwmc3200wifi-objs += commands.o cfg80211.o eeprom.o
-iwmc3200wifi-$(CONFIG_IWM_DEBUG) += debugfs.o
-iwmc3200wifi-$(CONFIG_IWM_TRACING) += trace.o
-CFLAGS_trace.o := -I$(src)
-ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/net/wireless/iwmc3200wifi/bus.h b/drivers/net/wireless/iwmc3200wifi/bus.h
deleted file mode 100644
index 62edd5888a7b..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/bus.h
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version
- * 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- *
- */
-#ifndef __IWM_BUS_H__
-#define __IWM_BUS_H__
-#include "iwm.h"
-struct iwm_if_ops {
-        int (*enable)(struct iwm_priv *iwm);
-        int (*disable)(struct iwm_priv *iwm);
-        int (*send_chunk)(struct iwm_priv *iwm, u8* buf, int count);
-        void (*debugfs_init)(struct iwm_priv *iwm, struct dentry *parent_dir);
-        void (*debugfs_exit)(struct iwm_priv *iwm);
-        const char *umac_name;
-        const char *calib_lmac_name;
-        const char *lmac_name;
-};
-static inline int iwm_bus_send_chunk(struct iwm_priv *iwm, u8 *buf, int count)
-{
-        return iwm->bus_ops->send_chunk(iwm, buf, count);
-}
-static inline int iwm_bus_enable(struct iwm_priv *iwm)
-{
-        return iwm->bus_ops->enable(iwm);
-}
-static inline int iwm_bus_disable(struct iwm_priv *iwm)
-{
-        return iwm->bus_ops->disable(iwm);
-}
-#endif
diff --git a/drivers/net/wireless/iwmc3200wifi/cfg80211.c b/drivers/net/wireless/iwmc3200wifi/cfg80211.c
deleted file mode 100644
index 48e8218fd23b..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/cfg80211.c
+++ /dev/null
@@ -1,882 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version
- * 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- *
- */
-#include <linux/kernel.h>
-#include <linux/netdevice.h>
-#include <linux/sched.h>
-#include <linux/etherdevice.h>
-#include <linux/wireless.h>
-#include <linux/ieee80211.h>
-#include <linux/slab.h>
-#include <net/cfg80211.h>
-#include "iwm.h"
-#include "commands.h"
-#include "cfg80211.h"
-#include "debug.h"
-#define RATETAB_ENT(_rate, _rateid, _flags) \
-        {                                                               \
-                .bitrate        = (_rate),                              \
-                .hw_value       = (_rateid),                            \
-                .flags          = (_flags),                             \
-        }
-#define CHAN2G(_channel, _freq, _flags) {                       \
-        .band                   = IEEE80211_BAND_2GHZ,          \
-        .center_freq            = (_freq),                      \
-        .hw_value               = (_channel),                   \
-        .flags                  = (_flags),                     \
-        .max_antenna_gain       = 0,                            \
-        .max_power              = 30,                           \
-}
-#define CHAN5G(_channel, _flags) {                              \
-        .band                   = IEEE80211_BAND_5GHZ,          \
-        .center_freq            = 5000 + (5 * (_channel)),      \
-        .hw_value               = (_channel),                   \
-        .flags                  = (_flags),                     \
-        .max_antenna_gain       = 0,                            \
-        .max_power              = 30,                           \
-}
-static struct ieee80211_rate iwm_rates[] = {
-        RATETAB_ENT(10,  0x1,   0),
-        RATETAB_ENT(20,  0x2,   0),
-        RATETAB_ENT(55,  0x4,   0),
-        RATETAB_ENT(110, 0x8,   0),
-        RATETAB_ENT(60,  0x10,  0),
-        RATETAB_ENT(90,  0x20,  0),
-        RATETAB_ENT(120, 0x40,  0),
-        RATETAB_ENT(180, 0x80,  0),
-        RATETAB_ENT(240, 0x100, 0),
-        RATETAB_ENT(360, 0x200, 0),
-        RATETAB_ENT(480, 0x400, 0),
-        RATETAB_ENT(540, 0x800, 0),
-};
-#define iwm_a_rates             (iwm_rates + 4)
-#define iwm_a_rates_size        8
-#define iwm_g_rates             (iwm_rates + 0)
-#define iwm_g_rates_size        12
-static struct ieee80211_channel iwm_2ghz_channels[] = {
-        CHAN2G(1, 2412, 0),
-        CHAN2G(2, 2417, 0),
-        CHAN2G(3, 2422, 0),
-        CHAN2G(4, 2427, 0),
-        CHAN2G(5, 2432, 0),
-        CHAN2G(6, 2437, 0),
-        CHAN2G(7, 2442, 0),
-        CHAN2G(8, 2447, 0),
-        CHAN2G(9, 2452, 0),
-        CHAN2G(10, 2457, 0),
-        CHAN2G(11, 2462, 0),
-        CHAN2G(12, 2467, 0),
-        CHAN2G(13, 2472, 0),
-        CHAN2G(14, 2484, 0),
-};
-static struct ieee80211_channel iwm_5ghz_a_channels[] = {
-        CHAN5G(34, 0),          CHAN5G(36, 0),
-        CHAN5G(38, 0),          CHAN5G(40, 0),
-        CHAN5G(42, 0),          CHAN5G(44, 0),
-        CHAN5G(46, 0),          CHAN5G(48, 0),
-        CHAN5G(52, 0),          CHAN5G(56, 0),
-        CHAN5G(60, 0),          CHAN5G(64, 0),
-        CHAN5G(100, 0),         CHAN5G(104, 0),
-        CHAN5G(108, 0),         CHAN5G(112, 0),
-        CHAN5G(116, 0),         CHAN5G(120, 0),
-        CHAN5G(124, 0),         CHAN5G(128, 0),
-        CHAN5G(132, 0),         CHAN5G(136, 0),
-        CHAN5G(140, 0),         CHAN5G(149, 0),
-        CHAN5G(153, 0),         CHAN5G(157, 0),
-        CHAN5G(161, 0),         CHAN5G(165, 0),
-        CHAN5G(184, 0),         CHAN5G(188, 0),
-        CHAN5G(192, 0),         CHAN5G(196, 0),
-        CHAN5G(200, 0),         CHAN5G(204, 0),
-        CHAN5G(208, 0),         CHAN5G(212, 0),
-        CHAN5G(216, 0),
-};
-static struct ieee80211_supported_band iwm_band_2ghz = {
-        .channels = iwm_2ghz_channels,
-        .n_channels = ARRAY_SIZE(iwm_2ghz_channels),
-        .bitrates = iwm_g_rates,
-        .n_bitrates = iwm_g_rates_size,
-};
-static struct ieee80211_supported_band iwm_band_5ghz = {
-        .channels = iwm_5ghz_a_channels,
-        .n_channels = ARRAY_SIZE(iwm_5ghz_a_channels),
-        .bitrates = iwm_a_rates,
-        .n_bitrates = iwm_a_rates_size,
-};
-static int iwm_key_init(struct iwm_key *key, u8 key_index,
-                        const u8 *mac_addr, struct key_params *params)
-{
-        key->hdr.key_idx = key_index;
-        if (!mac_addr || is_broadcast_ether_addr(mac_addr)) {
-                key->hdr.multicast = 1;
-                memset(key->hdr.mac, 0xff, ETH_ALEN);
-        } else {
-                key->hdr.multicast = 0;
-                memcpy(key->hdr.mac, mac_addr, ETH_ALEN);
-        }
-        if (params) {
-                if (params->key_len > WLAN_MAX_KEY_LEN ||
-                    params->seq_len > IW_ENCODE_SEQ_MAX_SIZE)
-                        return -EINVAL;
-                key->cipher = params->cipher;
-                key->key_len = params->key_len;
-                key->seq_len = params->seq_len;
-                memcpy(key->key, params->key, key->key_len);
-                memcpy(key->seq, params->seq, key->seq_len);
-        }
-        return 0;
-}
-static int iwm_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
-                                u8 key_index, bool pairwise, const u8 *mac_addr,
-                                struct key_params *params)
-{
-        struct iwm_priv *iwm = ndev_to_iwm(ndev);
-        struct iwm_key *key;
-        int ret;
-        IWM_DBG_WEXT(iwm, DBG, "Adding key for %pM\n", mac_addr);
-        if (key_index >= IWM_NUM_KEYS)
-                return -ENOENT;
-        key = &iwm->keys[key_index];
-        memset(key, 0, sizeof(struct iwm_key));
-        ret = iwm_key_init(key, key_index, mac_addr, params);
-        if (ret < 0) {
-                IWM_ERR(iwm, "Invalid key_params\n");
-                return ret;
-        }
-        return iwm_set_key(iwm, 0, key);
-}
-static int iwm_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
-                                u8 key_index, bool pairwise, const u8 *mac_addr,
-                                void *cookie,
-                                void (*callback)(void *cookie,
-                                                 struct key_params*))
-{
-        struct iwm_priv *iwm = ndev_to_iwm(ndev);
-        struct iwm_key *key;
-        struct key_params params;
-        IWM_DBG_WEXT(iwm, DBG, "Getting key %d\n", key_index);
-        if (key_index >= IWM_NUM_KEYS)
-                return -ENOENT;
-        memset(&params, 0, sizeof(params));
-        key = &iwm->keys[key_index];
-        params.cipher = key->cipher;
-        params.key_len = key->key_len;
-        params.seq_len = key->seq_len;
-        params.seq = key->seq;
-        params.key = key->key;
-        callback(cookie, &params);
-        return key->key_len ? 0 : -ENOENT;
-}
-static int iwm_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
-                                u8 key_index, bool pairwise, const u8 *mac_addr)
-{
-        struct iwm_priv *iwm = ndev_to_iwm(ndev);
-        struct iwm_key *key;
-        if (key_index >= IWM_NUM_KEYS)
-                return -ENOENT;
-        key = &iwm->keys[key_index];
-        if (!iwm->keys[key_index].key_len) {
-                IWM_DBG_WEXT(iwm, DBG, "Key %d not used\n", key_index);
-                return 0;
-        }
-        if (key_index == iwm->default_key)
-                iwm->default_key = -1;
-        return iwm_set_key(iwm, 1, key);
-}
-static int iwm_cfg80211_set_default_key(struct wiphy *wiphy,
-                                        struct net_device *ndev,
-                                        u8 key_index, bool unicast,
-                                        bool multicast)
-{
-        struct iwm_priv *iwm = ndev_to_iwm(ndev);
-        IWM_DBG_WEXT(iwm, DBG, "Default key index is: %d\n", key_index);
-        if (key_index >= IWM_NUM_KEYS)
-                return -ENOENT;
-        if (!iwm->keys[key_index].key_len) {
-                IWM_ERR(iwm, "Key %d not used\n", key_index);
-                return -EINVAL;
-        }
-        iwm->default_key = key_index;
-        return iwm_set_tx_key(iwm, key_index);
-}
-static int iwm_cfg80211_get_station(struct wiphy *wiphy,
-                                    struct net_device *ndev,
-                                    u8 *mac, struct station_info *sinfo)
-{
-        struct iwm_priv *iwm = ndev_to_iwm(ndev);
-        if (memcmp(mac, iwm->bssid, ETH_ALEN))
-                return -ENOENT;
-        sinfo->filled |= STATION_INFO_TX_BITRATE;
-        sinfo->txrate.legacy = iwm->rate * 10;
-        if (test_bit(IWM_STATUS_ASSOCIATED, &iwm->status)) {
-                sinfo->filled |= STATION_INFO_SIGNAL;
-                sinfo->signal = iwm->wstats.qual.level;
-        }
-        return 0;
-}
-int iwm_cfg80211_inform_bss(struct iwm_priv *iwm)
-{
-        struct wiphy *wiphy = iwm_to_wiphy(iwm);
-        struct iwm_bss_info *bss;
-        struct iwm_umac_notif_bss_info *umac_bss;
-        struct ieee80211_mgmt *mgmt;
-        struct ieee80211_channel *channel;
-        struct ieee80211_supported_band *band;
-        s32 signal;
-        int freq;
-        list_for_each_entry(bss, &iwm->bss_list, node) {
-                umac_bss = bss->bss;
-                mgmt = (struct ieee80211_mgmt *)(umac_bss->frame_buf);
-                if (umac_bss->band == UMAC_BAND_2GHZ)
-                        band = wiphy->bands[IEEE80211_BAND_2GHZ];
-                else if (umac_bss->band == UMAC_BAND_5GHZ)
-                        band = wiphy->bands[IEEE80211_BAND_5GHZ];
-                else {
-                        IWM_ERR(iwm, "Invalid band: %d\n", umac_bss->band);
-                        return -EINVAL;
-                }
-                freq = ieee80211_channel_to_frequency(umac_bss->channel,
-                                                      band->band);
-                channel = ieee80211_get_channel(wiphy, freq);
-                signal = umac_bss->rssi * 100;
-                if (!cfg80211_inform_bss_frame(wiphy, channel, mgmt,
-                                               le16_to_cpu(umac_bss->frame_len),
-                                               signal, GFP_KERNEL))
-                        return -EINVAL;
-        }
-        return 0;
-}
-static int iwm_cfg80211_change_iface(struct wiphy *wiphy,
-                                     struct net_device *ndev,
-                                     enum nl80211_iftype type, u32 *flags,
-                                     struct vif_params *params)
-{
-        struct wireless_dev *wdev;
-        struct iwm_priv *iwm;
-        u32 old_mode;
-        wdev = ndev->ieee80211_ptr;
-        iwm = ndev_to_iwm(ndev);
-        old_mode = iwm->conf.mode;
-        switch (type) {
-        case NL80211_IFTYPE_STATION:
-                iwm->conf.mode = UMAC_MODE_BSS;
-                break;
-        case NL80211_IFTYPE_ADHOC:
-                iwm->conf.mode = UMAC_MODE_IBSS;
-                break;
-        default:
-                return -EOPNOTSUPP;
-        }
-        wdev->iftype = type;
-        if ((old_mode == iwm->conf.mode) || !iwm->umac_profile)
-                return 0;
-        iwm->umac_profile->mode = cpu_to_le32(iwm->conf.mode);
-        if (iwm->umac_profile_active)
-                iwm_invalidate_mlme_profile(iwm);
-        return 0;
-}
-static int iwm_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
-                             struct cfg80211_scan_request *request)
-{
-        struct iwm_priv *iwm = ndev_to_iwm(ndev);
-        int ret;
-        if (!test_bit(IWM_STATUS_READY, &iwm->status)) {
-                IWM_ERR(iwm, "Scan while device is not ready\n");
-                return -EIO;
-        }
-        if (test_bit(IWM_STATUS_SCANNING, &iwm->status)) {
-                IWM_ERR(iwm, "Scanning already\n");
-                return -EAGAIN;
-        }
-        if (test_bit(IWM_STATUS_SCAN_ABORTING, &iwm->status)) {
-                IWM_ERR(iwm, "Scanning being aborted\n");
-                return -EAGAIN;
-        }
-        set_bit(IWM_STATUS_SCANNING, &iwm->status);
-        ret = iwm_scan_ssids(iwm, request->ssids, request->n_ssids);
-        if (ret) {
-                clear_bit(IWM_STATUS_SCANNING, &iwm->status);
-                return ret;
-        }
-        iwm->scan_request = request;
-        return 0;
-}
-static int iwm_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
-{
-        struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
-        if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
-            (iwm->conf.rts_threshold != wiphy->rts_threshold)) {
-                int ret;
-                iwm->conf.rts_threshold = wiphy->rts_threshold;
-                ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
-                                             CFG_RTS_THRESHOLD,
-                                             iwm->conf.rts_threshold);
-                if (ret < 0)
-                        return ret;
-        }
-        if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
-            (iwm->conf.frag_threshold != wiphy->frag_threshold)) {
-                int ret;
-                iwm->conf.frag_threshold = wiphy->frag_threshold;
-                ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_FA_CFG_FIX,
-                                             CFG_FRAG_THRESHOLD,
-                                             iwm->conf.frag_threshold);
-                if (ret < 0)
-                        return ret;
-        }
-        return 0;
-}
-static int iwm_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
-                                  struct cfg80211_ibss_params *params)
-{
-        struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
-        struct ieee80211_channel *chan = params->channel;
-        if (!test_bit(IWM_STATUS_READY, &iwm->status))
-                return -EIO;
-        /* UMAC doesn't support creating or joining an IBSS network
-         * with specified bssid. */
-        if (params->bssid)
-                return -EOPNOTSUPP;
-        iwm->channel = ieee80211_frequency_to_channel(chan->center_freq);
-        iwm->umac_profile->ibss.band = chan->band;
-        iwm->umac_profile->ibss.channel = iwm->channel;
-        iwm->umac_profile->ssid.ssid_len = params->ssid_len;
-        memcpy(iwm->umac_profile->ssid.ssid, params->ssid, params->ssid_len);
-        return iwm_send_mlme_profile(iwm);
-}
-static int iwm_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
-{
-        struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
-        if (iwm->umac_profile_active)
-                return iwm_invalidate_mlme_profile(iwm);
-        return 0;
-}
-static int iwm_set_auth_type(struct iwm_priv *iwm,
-                             enum nl80211_auth_type sme_auth_type)
-{
-        u8 *auth_type = &iwm->umac_profile->sec.auth_type;
-        switch (sme_auth_type) {
-        case NL80211_AUTHTYPE_AUTOMATIC:
-        case NL80211_AUTHTYPE_OPEN_SYSTEM:
-                IWM_DBG_WEXT(iwm, DBG, "OPEN auth\n");
-                *auth_type = UMAC_AUTH_TYPE_OPEN;
-                break;
-        case NL80211_AUTHTYPE_SHARED_KEY:
-                if (iwm->umac_profile->sec.flags &
-                    (UMAC_SEC_FLG_WPA_ON_MSK | UMAC_SEC_FLG_RSNA_ON_MSK)) {
-                        IWM_DBG_WEXT(iwm, DBG, "WPA auth alg\n");
-                        *auth_type = UMAC_AUTH_TYPE_RSNA_PSK;
-                } else {
-                        IWM_DBG_WEXT(iwm, DBG, "WEP shared key auth alg\n");
-                        *auth_type = UMAC_AUTH_TYPE_LEGACY_PSK;
-                }
-                break;
-        default:
-                IWM_ERR(iwm, "Unsupported auth alg: 0x%x\n", sme_auth_type);
-                return -ENOTSUPP;
-        }
-        return 0;
-}
-static int iwm_set_wpa_version(struct iwm_priv *iwm, u32 wpa_version)
-{
-        IWM_DBG_WEXT(iwm, DBG, "wpa_version: %d\n", wpa_version);
-        if (!wpa_version) {
-                iwm->umac_profile->sec.flags = UMAC_SEC_FLG_LEGACY_PROFILE;
-                return 0;
-        }
-        if (wpa_version & NL80211_WPA_VERSION_1)
-                iwm->umac_profile->sec.flags = UMAC_SEC_FLG_WPA_ON_MSK;
-        if (wpa_version & NL80211_WPA_VERSION_2)
-                iwm->umac_profile->sec.flags = UMAC_SEC_FLG_RSNA_ON_MSK;
-        return 0;
-}
-static int iwm_set_cipher(struct iwm_priv *iwm, u32 cipher, bool ucast)
-{
-        u8 *profile_cipher = ucast ? &iwm->umac_profile->sec.ucast_cipher :
-                &iwm->umac_profile->sec.mcast_cipher;
-        if (!cipher) {
-                *profile_cipher = UMAC_CIPHER_TYPE_NONE;
-                return 0;
-        }
-        IWM_DBG_WEXT(iwm, DBG, "%ccast cipher is 0x%x\n", ucast ? 'u' : 'm',
-                     cipher);
-        switch (cipher) {
-        case IW_AUTH_CIPHER_NONE:
-                *profile_cipher = UMAC_CIPHER_TYPE_NONE;
-                break;
-        case WLAN_CIPHER_SUITE_WEP40:
-                *profile_cipher = UMAC_CIPHER_TYPE_WEP_40;
-                break;
-        case WLAN_CIPHER_SUITE_WEP104:
-                *profile_cipher = UMAC_CIPHER_TYPE_WEP_104;
-                break;
-        case WLAN_CIPHER_SUITE_TKIP:
-                *profile_cipher = UMAC_CIPHER_TYPE_TKIP;
-                break;
-        case WLAN_CIPHER_SUITE_CCMP:
-                *profile_cipher = UMAC_CIPHER_TYPE_CCMP;
-                break;
-        default:
-                IWM_ERR(iwm, "Unsupported cipher: 0x%x\n", cipher);
-                return -ENOTSUPP;
-        }
-        return 0;
-}
-static int iwm_set_key_mgt(struct iwm_priv *iwm, u32 key_mgt)
-{
-        u8 *auth_type = &iwm->umac_profile->sec.auth_type;
-        IWM_DBG_WEXT(iwm, DBG, "key_mgt: 0x%x\n", key_mgt);
-        if (key_mgt == WLAN_AKM_SUITE_8021X)
-                *auth_type = UMAC_AUTH_TYPE_8021X;
-        else if (key_mgt == WLAN_AKM_SUITE_PSK) {
-                if (iwm->umac_profile->sec.flags &
-                    (UMAC_SEC_FLG_WPA_ON_MSK | UMAC_SEC_FLG_RSNA_ON_MSK))
-                        *auth_type = UMAC_AUTH_TYPE_RSNA_PSK;
-                else
-                        *auth_type = UMAC_AUTH_TYPE_LEGACY_PSK;
-        } else {
-                IWM_ERR(iwm, "Invalid key mgt: 0x%x\n", key_mgt);
-                return -EINVAL;
-        }
-        return 0;
-}
-static int iwm_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
-                                 struct cfg80211_connect_params *sme)
-{
-        struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
-        struct ieee80211_channel *chan = sme->channel;
-        struct key_params key_param;
-        int ret;
-        if (!test_bit(IWM_STATUS_READY, &iwm->status))
-                return -EIO;
-        if (!sme->ssid)
-                return -EINVAL;
-        if (iwm->umac_profile_active) {
-                ret = iwm_invalidate_mlme_profile(iwm);
-                if (ret) {
-                        IWM_ERR(iwm, "Couldn't invalidate profile\n");
-                        return ret;
-                }
-        }
-        if (chan)
-                iwm->channel =
-                        ieee80211_frequency_to_channel(chan->center_freq);
-        iwm->umac_profile->ssid.ssid_len = sme->ssid_len;
-        memcpy(iwm->umac_profile->ssid.ssid, sme->ssid, sme->ssid_len);
-        if (sme->bssid) {
-                IWM_DBG_WEXT(iwm, DBG, "BSSID: %pM\n", sme->bssid);
-                memcpy(&iwm->umac_profile->bssid[0], sme->bssid, ETH_ALEN);
-                iwm->umac_profile->bss_num = 1;
-        } else {
-                memset(&iwm->umac_profile->bssid[0], 0, ETH_ALEN);
-                iwm->umac_profile->bss_num = 0;
-        }
-        ret = iwm_set_wpa_version(iwm, sme->crypto.wpa_versions);
-        if (ret < 0)
-                return ret;
-        ret = iwm_set_auth_type(iwm, sme->auth_type);
-        if (ret < 0)
-                return ret;
-        if (sme->crypto.n_ciphers_pairwise) {
-                ret = iwm_set_cipher(iwm, sme->crypto.ciphers_pairwise[0],
-                                     true);
-                if (ret < 0)
-                        return ret;
-        }
-        ret = iwm_set_cipher(iwm, sme->crypto.cipher_group, false);
-        if (ret < 0)
-                return ret;
-        if (sme->crypto.n_akm_suites) {
-                ret = iwm_set_key_mgt(iwm, sme->crypto.akm_suites[0]);
-                if (ret < 0)
-                        return ret;
-        }
-        /*
-         * We save the WEP key in case we want to do shared authentication.
-         * We have to do it so because UMAC will assert whenever it gets a
-         * key before a profile.
-         */
-        if (sme->key) {
-                key_param.key = kmemdup(sme->key, sme->key_len, GFP_KERNEL);
-                if (key_param.key == NULL)
-                        return -ENOMEM;
-                key_param.key_len = sme->key_len;
-                key_param.seq_len = 0;
-                key_param.cipher = sme->crypto.ciphers_pairwise[0];
-                ret = iwm_key_init(&iwm->keys[sme->key_idx], sme->key_idx,
-                                   NULL, &key_param);
-                kfree(key_param.key);
-                if (ret < 0) {
-                        IWM_ERR(iwm, "Invalid key_params\n");
-                        return ret;
-                }
-                iwm->default_key = sme->key_idx;
-        }
-        /* WPA and open AUTH type from wpa_s means WPS (a.k.a. WSC) */
-        if ((iwm->umac_profile->sec.flags &
-             (UMAC_SEC_FLG_WPA_ON_MSK | UMAC_SEC_FLG_RSNA_ON_MSK)) &&
-            iwm->umac_profile->sec.auth_type == UMAC_AUTH_TYPE_OPEN) {
-                        iwm->umac_profile->sec.flags = UMAC_SEC_FLG_WSC_ON_MSK;
-        }
-        ret = iwm_send_mlme_profile(iwm);
-        if (iwm->umac_profile->sec.auth_type != UMAC_AUTH_TYPE_LEGACY_PSK ||
-            sme->key == NULL)
-                return ret;
-        /*
-         * We want to do shared auth.
-         * We need to actually set the key we previously cached,
-         * and then tell the UMAC it's the default one.
-         * That will trigger the auth+assoc UMAC machinery, and again,
-         * this must be done after setting the profile.
-         */
-        ret = iwm_set_key(iwm, 0, &iwm->keys[sme->key_idx]);
-        if (ret < 0)
-                return ret;
-        return iwm_set_tx_key(iwm, iwm->default_key);
-}
-static int iwm_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
-                                   u16 reason_code)
-{
-        struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
-        IWM_DBG_WEXT(iwm, DBG, "Active: %d\n", iwm->umac_profile_active);
-        if (iwm->umac_profile_active)
-                iwm_invalidate_mlme_profile(iwm);
-        return 0;
-}
-static int iwm_cfg80211_set_txpower(struct wiphy *wiphy,
-                                    enum nl80211_tx_power_setting type, int mbm)
-{
-        struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
-        int ret;
-        switch (type) {
-        case NL80211_TX_POWER_AUTOMATIC:
-                return 0;
-        case NL80211_TX_POWER_FIXED:
-                if (mbm < 0 || (mbm % 100))
-                        return -EOPNOTSUPP;
-                if (!test_bit(IWM_STATUS_READY, &iwm->status))
-                        return 0;
-                ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
-                                              CFG_TX_PWR_LIMIT_USR,
-                                              MBM_TO_DBM(mbm) * 2);
-                if (ret < 0)
-                        return ret;
-                return iwm_tx_power_trigger(iwm);
-        default:
-                IWM_ERR(iwm, "Unsupported power type: %d\n", type);
-                return -EOPNOTSUPP;
-        }
-        return 0;
-}
-static int iwm_cfg80211_get_txpower(struct wiphy *wiphy, int *dbm)
-{
-        struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
-        *dbm = iwm->txpower >> 1;
-        return 0;
-}
-static int iwm_cfg80211_set_power_mgmt(struct wiphy *wiphy,
-                                       struct net_device *dev,
-                                       bool enabled, int timeout)
-{
-        struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
-        u32 power_index;
-        if (enabled)
-                power_index = IWM_POWER_INDEX_DEFAULT;
-        else
-                power_index = IWM_POWER_INDEX_MIN;
-        if (power_index == iwm->conf.power_index)
-                return 0;
-        iwm->conf.power_index = power_index;
-        return iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
-                                       CFG_POWER_INDEX, iwm->conf.power_index);
-}
-static int iwm_cfg80211_set_pmksa(struct wiphy *wiphy,
-                                  struct net_device *netdev,
-                                  struct cfg80211_pmksa *pmksa)
-{
-        struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
-        return iwm_send_pmkid_update(iwm, pmksa, IWM_CMD_PMKID_ADD);
-}
-static int iwm_cfg80211_del_pmksa(struct wiphy *wiphy,
-                                  struct net_device *netdev,
-                                  struct cfg80211_pmksa *pmksa)
-{
-        struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
-        return iwm_send_pmkid_update(iwm, pmksa, IWM_CMD_PMKID_DEL);
-}
-static int iwm_cfg80211_flush_pmksa(struct wiphy *wiphy,
-                                    struct net_device *netdev)
-{
-        struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
-        struct cfg80211_pmksa pmksa;
-        memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
-        return iwm_send_pmkid_update(iwm, &pmksa, IWM_CMD_PMKID_FLUSH);
-}
-static struct cfg80211_ops iwm_cfg80211_ops = {
-        .change_virtual_intf = iwm_cfg80211_change_iface,
-        .add_key = iwm_cfg80211_add_key,
-        .get_key = iwm_cfg80211_get_key,
-        .del_key = iwm_cfg80211_del_key,
-        .set_default_key = iwm_cfg80211_set_default_key,
-        .get_station = iwm_cfg80211_get_station,
-        .scan = iwm_cfg80211_scan,
-        .set_wiphy_params = iwm_cfg80211_set_wiphy_params,
-        .connect = iwm_cfg80211_connect,
-        .disconnect = iwm_cfg80211_disconnect,
-        .join_ibss = iwm_cfg80211_join_ibss,
-        .leave_ibss = iwm_cfg80211_leave_ibss,
-        .set_tx_power = iwm_cfg80211_set_txpower,
-        .get_tx_power = iwm_cfg80211_get_txpower,
-        .set_power_mgmt = iwm_cfg80211_set_power_mgmt,
-        .set_pmksa = iwm_cfg80211_set_pmksa,
-        .del_pmksa = iwm_cfg80211_del_pmksa,
-        .flush_pmksa = iwm_cfg80211_flush_pmksa,
-};
-static const u32 cipher_suites[] = {
-        WLAN_CIPHER_SUITE_WEP40,
-        WLAN_CIPHER_SUITE_WEP104,
-        WLAN_CIPHER_SUITE_TKIP,
-        WLAN_CIPHER_SUITE_CCMP,
-};
-struct wireless_dev *iwm_wdev_alloc(int sizeof_bus, struct device *dev)
-{
-        int ret = 0;
-        struct wireless_dev *wdev;
-        /*
-         * We're trying to have the following memory
-         * layout:
-         *
-         * +-------------------------+
-         * | struct wiphy            |
-         * +-------------------------+
-         * | struct iwm_priv         |
-         * +-------------------------+
-         * | bus private data        |
-         * | (e.g. iwm_priv_sdio)    |
-         * +-------------------------+
-         *
-         */
-        wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
-        if (!wdev) {
-                dev_err(dev, "Couldn't allocate wireless device\n");
-                return ERR_PTR(-ENOMEM);
-        }
-        wdev->wiphy = wiphy_new(&iwm_cfg80211_ops,
-                                sizeof(struct iwm_priv) + sizeof_bus);
-        if (!wdev->wiphy) {
-                dev_err(dev, "Couldn't allocate wiphy device\n");
-                ret = -ENOMEM;
-                goto out_err_new;
-        }
-        set_wiphy_dev(wdev->wiphy, dev);
-        wdev->wiphy->max_scan_ssids = UMAC_WIFI_IF_PROBE_OPTION_MAX;
-        wdev->wiphy->max_num_pmkids = UMAC_MAX_NUM_PMKIDS;
-        wdev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
-                                       BIT(NL80211_IFTYPE_ADHOC);
-        wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = &iwm_band_2ghz;
-        wdev->wiphy->bands[IEEE80211_BAND_5GHZ] = &iwm_band_5ghz;
-        wdev->wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
-        wdev->wiphy->cipher_suites = cipher_suites;
-        wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
-        ret = wiphy_register(wdev->wiphy);
-        if (ret < 0) {
-                dev_err(dev, "Couldn't register wiphy device\n");
-                goto out_err_register;
-        }
-        return wdev;
- out_err_register:
-        wiphy_free(wdev->wiphy);
- out_err_new:
-        kfree(wdev);
-        return ERR_PTR(ret);
-}
-void iwm_wdev_free(struct iwm_priv *iwm)
-{
-        struct wireless_dev *wdev = iwm_to_wdev(iwm);
-        if (!wdev)
-                return;
-        wiphy_unregister(wdev->wiphy);
-        wiphy_free(wdev->wiphy);
-        kfree(wdev);
-}
diff --git a/drivers/net/wireless/iwmc3200wifi/cfg80211.h b/drivers/net/wireless/iwmc3200wifi/cfg80211.h
deleted file mode 100644
index 56a34145acbf..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/cfg80211.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version
- * 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- *
- */
-#ifndef __IWM_CFG80211_H__
-#define __IWM_CFG80211_H__
-int iwm_cfg80211_inform_bss(struct iwm_priv *iwm);
-struct wireless_dev *iwm_wdev_alloc(int sizeof_bus, struct device *dev);
-void iwm_wdev_free(struct iwm_priv *iwm);
-#endif
diff --git a/drivers/net/wireless/iwmc3200wifi/commands.c b/drivers/net/wireless/iwmc3200wifi/commands.c
deleted file mode 100644
index bd75078c454b..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/commands.c
+++ /dev/null
@@ -1,1002 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- */
-#include <linux/kernel.h>
-#include <linux/wireless.h>
-#include <linux/etherdevice.h>
-#include <linux/ieee80211.h>
-#include <linux/sched.h>
-#include <linux/slab.h>
-#include <linux/moduleparam.h>
-#include "iwm.h"
-#include "bus.h"
-#include "hal.h"
-#include "umac.h"
-#include "commands.h"
-#include "debug.h"
-static int iwm_send_lmac_ptrough_cmd(struct iwm_priv *iwm,
-                                     u8 lmac_cmd_id,
-                                     const void *lmac_payload,
-                                     u16 lmac_payload_size,
-                                     u8 resp)
-{
-        struct iwm_udma_wifi_cmd udma_cmd = UDMA_LMAC_INIT;
-        struct iwm_umac_cmd umac_cmd;
-        struct iwm_lmac_cmd lmac_cmd;
-        lmac_cmd.id = lmac_cmd_id;
-        umac_cmd.id = UMAC_CMD_OPCODE_WIFI_PASS_THROUGH;
-        umac_cmd.resp = resp;
-        return iwm_hal_send_host_cmd(iwm, &udma_cmd, &umac_cmd, &lmac_cmd,
-                                     lmac_payload, lmac_payload_size);
-}
-int iwm_send_wifi_if_cmd(struct iwm_priv *iwm, void *payload, u16 payload_size,
-                         bool resp)
-{
-        struct iwm_umac_wifi_if *hdr = (struct iwm_umac_wifi_if *)payload;
-        struct iwm_udma_wifi_cmd udma_cmd = UDMA_UMAC_INIT;
-        struct iwm_umac_cmd umac_cmd;
-        int ret;
-        u8 oid = hdr->oid;
-        if (!test_bit(IWM_STATUS_READY, &iwm->status)) {
-                IWM_ERR(iwm, "Interface is not ready yet");
-                return -EAGAIN;
-        }
-        umac_cmd.id = UMAC_CMD_OPCODE_WIFI_IF_WRAPPER;
-        umac_cmd.resp = resp;
-        ret = iwm_hal_send_umac_cmd(iwm, &udma_cmd, &umac_cmd,
-                                    payload, payload_size);
-        if (resp) {
-                ret = wait_event_interruptible_timeout(iwm->wifi_ntfy_queue,
-                                   test_and_clear_bit(oid, &iwm->wifi_ntfy[0]),
-                                   3 * HZ);
-                return ret ? 0 : -EBUSY;
-        }
-        return ret;
-}
-static int modparam_wiwi = COEX_MODE_CM;
-module_param_named(wiwi, modparam_wiwi, int, 0644);
-MODULE_PARM_DESC(wiwi, "Wifi-WiMAX coexistence: 1=SA, 2=XOR, 3=CM (default)");
-static struct coex_event iwm_sta_xor_prio_tbl[COEX_EVENTS_NUM] =
-{
-        {4, 3, 0, COEX_UNASSOC_IDLE_FLAGS},
-        {4, 3, 0, COEX_UNASSOC_MANUAL_SCAN_FLAGS},
-        {4, 3, 0, COEX_UNASSOC_AUTO_SCAN_FLAGS},
-        {4, 3, 0, COEX_CALIBRATION_FLAGS},
-        {4, 3, 0, COEX_PERIODIC_CALIBRATION_FLAGS},
-        {4, 3, 0, COEX_CONNECTION_ESTAB_FLAGS},
-        {4, 3, 0, COEX_ASSOCIATED_IDLE_FLAGS},
-        {4, 3, 0, COEX_ASSOC_MANUAL_SCAN_FLAGS},
-        {4, 3, 0, COEX_ASSOC_AUTO_SCAN_FLAGS},
-        {4, 3, 0, COEX_ASSOC_ACTIVE_LEVEL_FLAGS},
-        {6, 3, 0, COEX_XOR_RF_ON_FLAGS},
-        {4, 3, 0, COEX_RF_OFF_FLAGS},
-        {6, 6, 0, COEX_STAND_ALONE_DEBUG_FLAGS},
-        {4, 3, 0, COEX_IPAN_ASSOC_LEVEL_FLAGS},
-        {4, 3, 0, COEX_RSRVD1_FLAGS},
-        {4, 3, 0, COEX_RSRVD2_FLAGS}
-};
-static struct coex_event iwm_sta_cm_prio_tbl[COEX_EVENTS_NUM] =
-{
-        {1, 1, 0, COEX_UNASSOC_IDLE_FLAGS},
-        {4, 4, 0, COEX_UNASSOC_MANUAL_SCAN_FLAGS},
-        {3, 3, 0, COEX_UNASSOC_AUTO_SCAN_FLAGS},
-        {6, 6, 0, COEX_CALIBRATION_FLAGS},
-        {3, 3, 0, COEX_PERIODIC_CALIBRATION_FLAGS},
-        {6, 5, 0, COEX_CONNECTION_ESTAB_FLAGS},
-        {4, 4, 0, COEX_ASSOCIATED_IDLE_FLAGS},
-        {4, 4, 0, COEX_ASSOC_MANUAL_SCAN_FLAGS},
-        {4, 4, 0, COEX_ASSOC_AUTO_SCAN_FLAGS},
-        {4, 4, 0, COEX_ASSOC_ACTIVE_LEVEL_FLAGS},
-        {1, 1, 0, COEX_RF_ON_FLAGS},
-        {1, 1, 0, COEX_RF_OFF_FLAGS},
-        {7, 7, 0, COEX_STAND_ALONE_DEBUG_FLAGS},
-        {5, 4, 0, COEX_IPAN_ASSOC_LEVEL_FLAGS},
-        {1, 1, 0, COEX_RSRVD1_FLAGS},
-        {1, 1, 0, COEX_RSRVD2_FLAGS}
-};
-int iwm_send_prio_table(struct iwm_priv *iwm)
-{
-        struct iwm_coex_prio_table_cmd coex_table_cmd;
-        u32 coex_enabled, mode_enabled;
-        memset(&coex_table_cmd, 0, sizeof(struct iwm_coex_prio_table_cmd));
-        coex_table_cmd.flags = COEX_FLAGS_STA_TABLE_VALID_MSK;
-        switch (modparam_wiwi) {
-        case COEX_MODE_XOR:
-        case COEX_MODE_CM:
-                coex_enabled = 1;
-                break;
-        default:
-                coex_enabled = 0;
-                break;
-        }
-        switch (iwm->conf.mode) {
-        case UMAC_MODE_BSS:
-        case UMAC_MODE_IBSS:
-                mode_enabled = 1;
-                break;
-        default:
-                mode_enabled = 0;
-                break;
-        }
-        if (coex_enabled && mode_enabled) {
-                coex_table_cmd.flags |= COEX_FLAGS_COEX_ENABLE_MSK |
-                                        COEX_FLAGS_ASSOC_WAKEUP_UMASK_MSK |
-                                        COEX_FLAGS_UNASSOC_WAKEUP_UMASK_MSK;
-                switch (modparam_wiwi) {
-                case COEX_MODE_XOR:
-                        memcpy(coex_table_cmd.sta_prio, iwm_sta_xor_prio_tbl,
-                               sizeof(iwm_sta_xor_prio_tbl));
-                        break;
-                case COEX_MODE_CM:
-                        memcpy(coex_table_cmd.sta_prio, iwm_sta_cm_prio_tbl,
-                               sizeof(iwm_sta_cm_prio_tbl));
-                        break;
-                default:
-                        IWM_ERR(iwm, "Invalid coex_mode 0x%x\n",
-                                modparam_wiwi);
-                        break;
-                }
-        } else
-                IWM_WARN(iwm, "coexistense disabled\n");
-        return iwm_send_lmac_ptrough_cmd(iwm, COEX_PRIORITY_TABLE_CMD,
-                                &coex_table_cmd,
-                                sizeof(struct iwm_coex_prio_table_cmd), 0);
-}
-int iwm_send_init_calib_cfg(struct iwm_priv *iwm, u8 calib_requested)
-{
-        struct iwm_lmac_cal_cfg_cmd cal_cfg_cmd;
-        memset(&cal_cfg_cmd, 0, sizeof(struct iwm_lmac_cal_cfg_cmd));
-        cal_cfg_cmd.ucode_cfg.init.enable = cpu_to_le32(calib_requested);
-        cal_cfg_cmd.ucode_cfg.init.start = cpu_to_le32(calib_requested);
-        cal_cfg_cmd.ucode_cfg.init.send_res = cpu_to_le32(calib_requested);
-        cal_cfg_cmd.ucode_cfg.flags =
-                cpu_to_le32(CALIB_CFG_FLAG_SEND_COMPLETE_NTFY_AFTER_MSK);
-        return iwm_send_lmac_ptrough_cmd(iwm, CALIBRATION_CFG_CMD, &cal_cfg_cmd,
-                                sizeof(struct iwm_lmac_cal_cfg_cmd), 1);
-}
-int iwm_send_periodic_calib_cfg(struct iwm_priv *iwm, u8 calib_requested)
-{
-        struct iwm_lmac_cal_cfg_cmd cal_cfg_cmd;
-        memset(&cal_cfg_cmd, 0, sizeof(struct iwm_lmac_cal_cfg_cmd));
-        cal_cfg_cmd.ucode_cfg.periodic.enable = cpu_to_le32(calib_requested);
-        cal_cfg_cmd.ucode_cfg.periodic.start = cpu_to_le32(calib_requested);
-        return iwm_send_lmac_ptrough_cmd(iwm, CALIBRATION_CFG_CMD, &cal_cfg_cmd,
-                                sizeof(struct iwm_lmac_cal_cfg_cmd), 0);
-}
-int iwm_store_rxiq_calib_result(struct iwm_priv *iwm)
-{
-        struct iwm_calib_rxiq *rxiq;
-        u8 *eeprom_rxiq = iwm_eeprom_access(iwm, IWM_EEPROM_CALIB_RXIQ);
-        int grplen = sizeof(struct iwm_calib_rxiq_group);
-        rxiq = kzalloc(sizeof(struct iwm_calib_rxiq), GFP_KERNEL);
-        if (!rxiq) {
-                IWM_ERR(iwm, "Couldn't alloc memory for RX IQ\n");
-                return -ENOMEM;
-        }
-        eeprom_rxiq = iwm_eeprom_access(iwm, IWM_EEPROM_CALIB_RXIQ);
-        if (IS_ERR(eeprom_rxiq)) {
-                IWM_ERR(iwm, "Couldn't access EEPROM RX IQ entry\n");
-                kfree(rxiq);
-                return PTR_ERR(eeprom_rxiq);
-        }
-        iwm->calib_res[SHILOH_PHY_CALIBRATE_RX_IQ_CMD].buf = (u8 *)rxiq;
-        iwm->calib_res[SHILOH_PHY_CALIBRATE_RX_IQ_CMD].size = sizeof(*rxiq);
-        rxiq->hdr.opcode = SHILOH_PHY_CALIBRATE_RX_IQ_CMD;
-        rxiq->hdr.first_grp = 0;
-        rxiq->hdr.grp_num = 1;
-        rxiq->hdr.all_data_valid = 1;
-        memcpy(&rxiq->group[0], eeprom_rxiq, 4 * grplen);
-        memcpy(&rxiq->group[4], eeprom_rxiq + 6 * grplen, grplen);
-        return 0;
-}
-int iwm_send_calib_results(struct iwm_priv *iwm)
-{
-        int i, ret = 0;
-        for (i = PHY_CALIBRATE_OPCODES_NUM; i < CALIBRATION_CMD_NUM; i++) {
-                if (test_bit(i - PHY_CALIBRATE_OPCODES_NUM,
-                             &iwm->calib_done_map)) {
-                        IWM_DBG_CMD(iwm, DBG,
-                                    "Send calibration %d result\n", i);
-                        ret |= iwm_send_lmac_ptrough_cmd(iwm,
-                                        REPLY_PHY_CALIBRATION_CMD,
-                                        iwm->calib_res[i].buf,
-                                        iwm->calib_res[i].size, 0);
-                        kfree(iwm->calib_res[i].buf);
-                        iwm->calib_res[i].buf = NULL;
-                        iwm->calib_res[i].size = 0;
-                }
-        }
-        return ret;
-}
-int iwm_send_ct_kill_cfg(struct iwm_priv *iwm, u8 entry, u8 exit)
-{
-        struct iwm_ct_kill_cfg_cmd cmd;
-        cmd.entry_threshold = entry;
-        cmd.exit_threshold = exit;
-        return iwm_send_lmac_ptrough_cmd(iwm, REPLY_CT_KILL_CONFIG_CMD, &cmd,
-                                         sizeof(struct iwm_ct_kill_cfg_cmd), 0);
-}
-int iwm_send_umac_reset(struct iwm_priv *iwm, __le32 reset_flags, bool resp)
-{
-        struct iwm_udma_wifi_cmd udma_cmd = UDMA_UMAC_INIT;
-        struct iwm_umac_cmd umac_cmd;
-        struct iwm_umac_cmd_reset reset;
-        reset.flags = reset_flags;
-        umac_cmd.id = UMAC_CMD_OPCODE_RESET;
-        umac_cmd.resp = resp;
-        return iwm_hal_send_umac_cmd(iwm, &udma_cmd, &umac_cmd, &reset,
-                                     sizeof(struct iwm_umac_cmd_reset));
-}
-int iwm_umac_set_config_fix(struct iwm_priv *iwm, u16 tbl, u16 key, u32 value)
-{
-        struct iwm_udma_wifi_cmd udma_cmd = UDMA_UMAC_INIT;
-        struct iwm_umac_cmd umac_cmd;
-        struct iwm_umac_cmd_set_param_fix param;
-        if ((tbl != UMAC_PARAM_TBL_CFG_FIX) &&
-            (tbl != UMAC_PARAM_TBL_FA_CFG_FIX))
-                return -EINVAL;
-        umac_cmd.id = UMAC_CMD_OPCODE_SET_PARAM_FIX;
-        umac_cmd.resp = 0;
-        param.tbl = cpu_to_le16(tbl);
-        param.key = cpu_to_le16(key);
-        param.value = cpu_to_le32(value);
-        return iwm_hal_send_umac_cmd(iwm, &udma_cmd, &umac_cmd, &param,
-                                     sizeof(struct iwm_umac_cmd_set_param_fix));
-}
-int iwm_umac_set_config_var(struct iwm_priv *iwm, u16 key,
-                            void *payload, u16 payload_size)
-{
-        struct iwm_udma_wifi_cmd udma_cmd = UDMA_UMAC_INIT;
-        struct iwm_umac_cmd umac_cmd;
-        struct iwm_umac_cmd_set_param_var *param_hdr;
-        u8 *param;
-        int ret;
-        param = kzalloc(payload_size +
-                        sizeof(struct iwm_umac_cmd_set_param_var), GFP_KERNEL);
-        if (!param) {
-                IWM_ERR(iwm, "Couldn't allocate param\n");
-                return -ENOMEM;
-        }
-        param_hdr = (struct iwm_umac_cmd_set_param_var *)param;
-        umac_cmd.id = UMAC_CMD_OPCODE_SET_PARAM_VAR;
-        umac_cmd.resp = 0;
-        param_hdr->tbl = cpu_to_le16(UMAC_PARAM_TBL_CFG_VAR);
-        param_hdr->key = cpu_to_le16(key);
-        param_hdr->len = cpu_to_le16(payload_size);
-        memcpy(param + sizeof(struct iwm_umac_cmd_set_param_var),
-               payload, payload_size);
-        ret = iwm_hal_send_umac_cmd(iwm, &udma_cmd, &umac_cmd, param,
-                                    sizeof(struct iwm_umac_cmd_set_param_var) +
-                                    payload_size);
-        kfree(param);
-        return ret;
-}
-int iwm_send_umac_config(struct iwm_priv *iwm, __le32 reset_flags)
-{
-        int ret;
-        /* Use UMAC default values */
-        ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
-                                      CFG_POWER_INDEX, iwm->conf.power_index);
-        if (ret < 0)
-                return ret;
-        ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_FA_CFG_FIX,
-                                      CFG_FRAG_THRESHOLD,
-                                      iwm->conf.frag_threshold);
-        if (ret < 0)
-                return ret;
-        ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
-                                      CFG_RTS_THRESHOLD,
-                                      iwm->conf.rts_threshold);
-        if (ret < 0)
-                return ret;
-        ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
-                                      CFG_CTS_TO_SELF, iwm->conf.cts_to_self);
-        if (ret < 0)
-                return ret;
-        ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
-                                      CFG_WIRELESS_MODE,
-                                      iwm->conf.wireless_mode);
-        if (ret < 0)
-                return ret;
-        ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
-                                      CFG_COEX_MODE, modparam_wiwi);
-        if (ret < 0)
-                return ret;
-        /*
-        ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
-                                      CFG_ASSOCIATION_TIMEOUT,
-                                      iwm->conf.assoc_timeout);
-        if (ret < 0)
-                return ret;
-        ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
-                                      CFG_ROAM_TIMEOUT,
-                                      iwm->conf.roam_timeout);
-        if (ret < 0)
-                return ret;
-        ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
-                                      CFG_WIRELESS_MODE,
-                                      WIRELESS_MODE_11A | WIRELESS_MODE_11G);
-        if (ret < 0)
-                return ret;
-        */
-        ret = iwm_umac_set_config_var(iwm, CFG_NET_ADDR,
-                                      iwm_to_ndev(iwm)->dev_addr, ETH_ALEN);
-        if (ret < 0)
-                return ret;
-        /* UMAC PM static configurations */
-        ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
-                                      CFG_PM_LEGACY_RX_TIMEOUT, 0x12C);
-        if (ret < 0)
-                return ret;
-        ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
-                                      CFG_PM_LEGACY_TX_TIMEOUT, 0x15E);
-        if (ret < 0)
-                return ret;
-        ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
-                                      CFG_PM_CTRL_FLAGS, 0x1);
-        if (ret < 0)
-                return ret;
-        ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
-                                      CFG_PM_KEEP_ALIVE_IN_BEACONS, 0x80);
-        if (ret < 0)
-                return ret;
-        /* reset UMAC */
-        ret = iwm_send_umac_reset(iwm, reset_flags, 1);
-        if (ret < 0)
-                return ret;
-        ret = iwm_notif_handle(iwm, UMAC_CMD_OPCODE_RESET, IWM_SRC_UMAC,
-                               WAIT_NOTIF_TIMEOUT);
-        if (ret) {
-                IWM_ERR(iwm, "Wait for UMAC RESET timeout\n");
-                return ret;
-        }
-        return ret;
-}
-int iwm_send_packet(struct iwm_priv *iwm, struct sk_buff *skb, int pool_id)
-{
-        struct iwm_udma_wifi_cmd udma_cmd;
-        struct iwm_umac_cmd umac_cmd;
-        struct iwm_tx_info *tx_info = skb_to_tx_info(skb);
-        udma_cmd.eop = 1; /* always set eop for non-concatenated Tx */
-        udma_cmd.credit_group = pool_id;
-        udma_cmd.ra_tid = tx_info->sta << 4 | tx_info->tid;
-        udma_cmd.lmac_offset = 0;
-        umac_cmd.id = REPLY_TX;
-        umac_cmd.color = tx_info->color;
-        umac_cmd.resp = 0;
-        return iwm_hal_send_umac_cmd(iwm, &udma_cmd, &umac_cmd,
-                                     skb->data, skb->len);
-}
-static int iwm_target_read(struct iwm_priv *iwm, __le32 address,
-                           u8 *response, u32 resp_size)
-{
-        struct iwm_udma_nonwifi_cmd target_cmd;
-        struct iwm_nonwifi_cmd *cmd;
-        u16 seq_num;
-        int ret = 0;
-        target_cmd.opcode = UMAC_HDI_OUT_OPCODE_READ;
-        target_cmd.addr = address;
-        target_cmd.op1_sz = cpu_to_le32(resp_size);
-        target_cmd.op2 = 0;
-        target_cmd.handle_by_hw = 0;
-        target_cmd.resp = 1;
-        target_cmd.eop = 1;
-        ret = iwm_hal_send_target_cmd(iwm, &target_cmd, NULL);
-        if (ret < 0) {
-                IWM_ERR(iwm, "Couldn't send READ command\n");
-                return ret;
-        }
-        /* When succeeding, the send_target routine returns the seq number */
-        seq_num = ret;
-        ret = wait_event_interruptible_timeout(iwm->nonwifi_queue,
-                (cmd = iwm_get_pending_nonwifi_cmd(iwm, seq_num,
-                                          UMAC_HDI_OUT_OPCODE_READ)) != NULL,
-                                               2 * HZ);
-        if (!ret) {
-                IWM_ERR(iwm, "Didn't receive a target READ answer\n");
-                return ret;
-        }
-        memcpy(response, cmd->buf.hdr + sizeof(struct iwm_udma_in_hdr),
-               resp_size);
-        kfree(cmd);
-        return 0;
-}
-int iwm_read_mac(struct iwm_priv *iwm, u8 *mac)
-{
-        int ret;
-        u8 mac_align[ALIGN(ETH_ALEN, 8)];
-        ret = iwm_target_read(iwm, cpu_to_le32(WICO_MAC_ADDRESS_ADDR),
-                              mac_align, sizeof(mac_align));
-        if (ret)
-                return ret;
-        if (is_valid_ether_addr(mac_align))
-                memcpy(mac, mac_align, ETH_ALEN);
-        else {
-                IWM_ERR(iwm, "Invalid EEPROM MAC\n");
-                memcpy(mac, iwm->conf.mac_addr, ETH_ALEN);
-                get_random_bytes(&mac[3], 3);
-        }
-        return 0;
-}
-static int iwm_check_profile(struct iwm_priv *iwm)
-{
-        if (!iwm->umac_profile_active)
-                return -EAGAIN;
-        if (iwm->umac_profile->sec.ucast_cipher != UMAC_CIPHER_TYPE_WEP_40 &&
-            iwm->umac_profile->sec.ucast_cipher != UMAC_CIPHER_TYPE_WEP_104 &&
-            iwm->umac_profile->sec.ucast_cipher != UMAC_CIPHER_TYPE_TKIP &&
-            iwm->umac_profile->sec.ucast_cipher != UMAC_CIPHER_TYPE_CCMP) {
-                IWM_ERR(iwm, "Wrong unicast cipher: 0x%x\n",
-                        iwm->umac_profile->sec.ucast_cipher);
-                return -EAGAIN;
-        }
-        if (iwm->umac_profile->sec.mcast_cipher != UMAC_CIPHER_TYPE_WEP_40 &&
-            iwm->umac_profile->sec.mcast_cipher != UMAC_CIPHER_TYPE_WEP_104 &&
-            iwm->umac_profile->sec.mcast_cipher != UMAC_CIPHER_TYPE_TKIP &&
-            iwm->umac_profile->sec.mcast_cipher != UMAC_CIPHER_TYPE_CCMP) {
-                IWM_ERR(iwm, "Wrong multicast cipher: 0x%x\n",
-                        iwm->umac_profile->sec.mcast_cipher);
-                return -EAGAIN;
-        }
-        if ((iwm->umac_profile->sec.ucast_cipher == UMAC_CIPHER_TYPE_WEP_40 ||
-             iwm->umac_profile->sec.ucast_cipher == UMAC_CIPHER_TYPE_WEP_104) &&
-            (iwm->umac_profile->sec.ucast_cipher !=
-             iwm->umac_profile->sec.mcast_cipher)) {
-                IWM_ERR(iwm, "Unicast and multicast ciphers differ for WEP\n");
-        }
-        return 0;
-}
-int iwm_set_tx_key(struct iwm_priv *iwm, u8 key_idx)
-{
-        struct iwm_umac_tx_key_id tx_key_id;
-        int ret;
-        ret = iwm_check_profile(iwm);
-        if (ret < 0)
-                return ret;
-        /* UMAC only allows to set default key for WEP and auth type is
-         * NOT 802.1X or RSNA. */
-        if ((iwm->umac_profile->sec.ucast_cipher != UMAC_CIPHER_TYPE_WEP_40 &&
-             iwm->umac_profile->sec.ucast_cipher != UMAC_CIPHER_TYPE_WEP_104) ||
-            iwm->umac_profile->sec.auth_type == UMAC_AUTH_TYPE_8021X ||
-            iwm->umac_profile->sec.auth_type == UMAC_AUTH_TYPE_RSNA_PSK)
-                return 0;
-        tx_key_id.hdr.oid = UMAC_WIFI_IF_CMD_GLOBAL_TX_KEY_ID;
-        tx_key_id.hdr.buf_size = cpu_to_le16(sizeof(struct iwm_umac_tx_key_id) -
-                                             sizeof(struct iwm_umac_wifi_if));
-        tx_key_id.key_idx = key_idx;
-        return iwm_send_wifi_if_cmd(iwm, &tx_key_id, sizeof(tx_key_id), 1);
-}
-int iwm_set_key(struct iwm_priv *iwm, bool remove, struct iwm_key *key)
-{
-        int ret = 0;
-        u8 cmd[64], *sta_addr, *key_data, key_len;
-        s8 key_idx;
-        u16 cmd_size = 0;
-        struct iwm_umac_key_hdr *key_hdr = &key->hdr;
-        struct iwm_umac_key_wep40 *wep40 = (struct iwm_umac_key_wep40 *)cmd;
-        struct iwm_umac_key_wep104 *wep104 = (struct iwm_umac_key_wep104 *)cmd;
-        struct iwm_umac_key_tkip *tkip = (struct iwm_umac_key_tkip *)cmd;
-        struct iwm_umac_key_ccmp *ccmp = (struct iwm_umac_key_ccmp *)cmd;
-        if (!remove) {
-                ret = iwm_check_profile(iwm);
-                if (ret < 0)
-                        return ret;
-        }
-        sta_addr = key->hdr.mac;
-        key_data = key->key;
-        key_len = key->key_len;
-        key_idx = key->hdr.key_idx;
-        if (!remove) {
-                u8 auth_type = iwm->umac_profile->sec.auth_type;
-                IWM_DBG_WEXT(iwm, DBG, "key_idx:%d\n", key_idx);
-                IWM_DBG_WEXT(iwm, DBG, "key_len:%d\n", key_len);
-                IWM_DBG_WEXT(iwm, DBG, "MAC:%pM, idx:%d, multicast:%d\n",
-                       key_hdr->mac, key_hdr->key_idx, key_hdr->multicast);
-                IWM_DBG_WEXT(iwm, DBG, "profile: mcast:0x%x, ucast:0x%x\n",
-                             iwm->umac_profile->sec.mcast_cipher,
-                             iwm->umac_profile->sec.ucast_cipher);
-                IWM_DBG_WEXT(iwm, DBG, "profile: auth_type:0x%x, flags:0x%x\n",
-                             iwm->umac_profile->sec.auth_type,
-                             iwm->umac_profile->sec.flags);
-                switch (key->cipher) {
-                case WLAN_CIPHER_SUITE_WEP40:
-                        wep40->hdr.oid = UMAC_WIFI_IF_CMD_ADD_WEP40_KEY;
-                        wep40->hdr.buf_size =
-                                cpu_to_le16(sizeof(struct iwm_umac_key_wep40) -
-                                            sizeof(struct iwm_umac_wifi_if));
-                        memcpy(&wep40->key_hdr, key_hdr,
-                               sizeof(struct iwm_umac_key_hdr));
-                        memcpy(wep40->key, key_data, key_len);
-                        wep40->static_key =
-                                !!((auth_type != UMAC_AUTH_TYPE_8021X) &&
-                                   (auth_type != UMAC_AUTH_TYPE_RSNA_PSK));
-                        cmd_size = sizeof(struct iwm_umac_key_wep40);
-                        break;
-                case WLAN_CIPHER_SUITE_WEP104:
-                        wep104->hdr.oid = UMAC_WIFI_IF_CMD_ADD_WEP104_KEY;
-                        wep104->hdr.buf_size =
-                                cpu_to_le16(sizeof(struct iwm_umac_key_wep104) -
-                                            sizeof(struct iwm_umac_wifi_if));
-                        memcpy(&wep104->key_hdr, key_hdr,
-                               sizeof(struct iwm_umac_key_hdr));
-                        memcpy(wep104->key, key_data, key_len);
-                        wep104->static_key =
-                                !!((auth_type != UMAC_AUTH_TYPE_8021X) &&
-                                   (auth_type != UMAC_AUTH_TYPE_RSNA_PSK));
-                        cmd_size = sizeof(struct iwm_umac_key_wep104);
-                        break;
-                case WLAN_CIPHER_SUITE_CCMP:
-                        key_hdr->key_idx++;
-                        ccmp->hdr.oid = UMAC_WIFI_IF_CMD_ADD_CCMP_KEY;
-                        ccmp->hdr.buf_size =
-                                cpu_to_le16(sizeof(struct iwm_umac_key_ccmp) -
-                                            sizeof(struct iwm_umac_wifi_if));
-                        memcpy(&ccmp->key_hdr, key_hdr,
-                               sizeof(struct iwm_umac_key_hdr));
-                        memcpy(ccmp->key, key_data, key_len);
-                        if (key->seq_len)
-                                memcpy(ccmp->iv_count, key->seq, key->seq_len);
-                        cmd_size = sizeof(struct iwm_umac_key_ccmp);
-                        break;
-                case WLAN_CIPHER_SUITE_TKIP:
-                        key_hdr->key_idx++;
-                        tkip->hdr.oid = UMAC_WIFI_IF_CMD_ADD_TKIP_KEY;
-                        tkip->hdr.buf_size =
-                                cpu_to_le16(sizeof(struct iwm_umac_key_tkip) -
-                                            sizeof(struct iwm_umac_wifi_if));
-                        memcpy(&tkip->key_hdr, key_hdr,
-                               sizeof(struct iwm_umac_key_hdr));
-                        memcpy(tkip->tkip_key, key_data, IWM_TKIP_KEY_SIZE);
-                        memcpy(tkip->mic_tx_key, key_data + IWM_TKIP_KEY_SIZE,
-                               IWM_TKIP_MIC_SIZE);
-                        memcpy(tkip->mic_rx_key,
-                               key_data + IWM_TKIP_KEY_SIZE + IWM_TKIP_MIC_SIZE,
-                               IWM_TKIP_MIC_SIZE);
-                        if (key->seq_len)
-                                memcpy(ccmp->iv_count, key->seq, key->seq_len);
-                        cmd_size = sizeof(struct iwm_umac_key_tkip);
-                        break;
-                default:
-                        return -ENOTSUPP;
-                }
-                if ((key->cipher == WLAN_CIPHER_SUITE_TKIP) ||
-                    (key->cipher == WLAN_CIPHER_SUITE_CCMP))
-                        /*
-                         * UGLY_UGLY_UGLY
-                         * Copied HACK from the MWG driver.
-                         * Without it, the key is set before the second
-                         * EAPOL frame is sent, and the latter is thus
-                         * encrypted.
-                         */
-                        schedule_timeout_interruptible(usecs_to_jiffies(300));
-                ret =  iwm_send_wifi_if_cmd(iwm, cmd, cmd_size, 1);
-        } else {
-                struct iwm_umac_key_remove key_remove;
-                IWM_DBG_WEXT(iwm, ERR, "Removing key_idx:%d\n", key_idx);
-                key_remove.hdr.oid = UMAC_WIFI_IF_CMD_REMOVE_KEY;
-                key_remove.hdr.buf_size =
-                        cpu_to_le16(sizeof(struct iwm_umac_key_remove) -
-                                    sizeof(struct iwm_umac_wifi_if));
-                memcpy(&key_remove.key_hdr, key_hdr,
-                       sizeof(struct iwm_umac_key_hdr));
-                ret =  iwm_send_wifi_if_cmd(iwm, &key_remove,
-                                            sizeof(struct iwm_umac_key_remove),
-                                            1);
-                if (ret)
-                        return ret;
-                iwm->keys[key_idx].key_len = 0;
-        }
-        return ret;
-}
-int iwm_send_mlme_profile(struct iwm_priv *iwm)
-{
-        int ret;
-        struct iwm_umac_profile profile;
-        memcpy(&profile, iwm->umac_profile, sizeof(profile));
-        profile.hdr.oid = UMAC_WIFI_IF_CMD_SET_PROFILE;
-        profile.hdr.buf_size = cpu_to_le16(sizeof(struct iwm_umac_profile) -
-                                           sizeof(struct iwm_umac_wifi_if));
-        ret = iwm_send_wifi_if_cmd(iwm, &profile, sizeof(profile), 1);
-        if (ret) {
-                IWM_ERR(iwm, "Send profile command failed\n");
-                return ret;
-        }
-        set_bit(IWM_STATUS_SME_CONNECTING, &iwm->status);
-        return 0;
-}
-int __iwm_invalidate_mlme_profile(struct iwm_priv *iwm)
-{
-        struct iwm_umac_invalidate_profile invalid;
-        invalid.hdr.oid = UMAC_WIFI_IF_CMD_INVALIDATE_PROFILE;
-        invalid.hdr.buf_size =
-                cpu_to_le16(sizeof(struct iwm_umac_invalidate_profile) -
-                            sizeof(struct iwm_umac_wifi_if));
-        invalid.reason = WLAN_REASON_UNSPECIFIED;
-        return iwm_send_wifi_if_cmd(iwm, &invalid, sizeof(invalid), 1);
-}
-int iwm_invalidate_mlme_profile(struct iwm_priv *iwm)
-{
-        int ret;
-        ret = __iwm_invalidate_mlme_profile(iwm);
-        if (ret)
-                return ret;
-        ret = wait_event_interruptible_timeout(iwm->mlme_queue,
-                                (iwm->umac_profile_active == 0), 5 * HZ);
-        return ret ? 0 : -EBUSY;
-}
-int iwm_tx_power_trigger(struct iwm_priv *iwm)
-{
-        struct iwm_umac_pwr_trigger pwr_trigger;
-        pwr_trigger.hdr.oid = UMAC_WIFI_IF_CMD_TX_PWR_TRIGGER;
-        pwr_trigger.hdr.buf_size =
-                cpu_to_le16(sizeof(struct iwm_umac_pwr_trigger) -
-                            sizeof(struct iwm_umac_wifi_if));
-        return iwm_send_wifi_if_cmd(iwm, &pwr_trigger, sizeof(pwr_trigger), 1);
-}
-int iwm_send_umac_stats_req(struct iwm_priv *iwm, u32 flags)
-{
-        struct iwm_udma_wifi_cmd udma_cmd = UDMA_UMAC_INIT;
-        struct iwm_umac_cmd umac_cmd;
-        struct iwm_umac_cmd_stats_req stats_req;
-        stats_req.flags = cpu_to_le32(flags);
-        umac_cmd.id = UMAC_CMD_OPCODE_STATISTIC_REQUEST;
-        umac_cmd.resp = 0;
-        return iwm_hal_send_umac_cmd(iwm, &udma_cmd, &umac_cmd, &stats_req,
-                                     sizeof(struct iwm_umac_cmd_stats_req));
-}
-int iwm_send_umac_channel_list(struct iwm_priv *iwm)
-{
-        struct iwm_udma_wifi_cmd udma_cmd = UDMA_UMAC_INIT;
-        struct iwm_umac_cmd umac_cmd;
-        struct iwm_umac_cmd_get_channel_list *ch_list;
-        int size = sizeof(struct iwm_umac_cmd_get_channel_list) +
-                   sizeof(struct iwm_umac_channel_info) * 4;
-        int ret;
-        ch_list = kzalloc(size, GFP_KERNEL);
-        if (!ch_list) {
-                IWM_ERR(iwm, "Couldn't allocate channel list cmd\n");
-                return -ENOMEM;
-        }
-        ch_list->ch[0].band = UMAC_BAND_2GHZ;
-        ch_list->ch[0].type = UMAC_CHANNEL_WIDTH_20MHZ;
-        ch_list->ch[0].flags = UMAC_CHANNEL_FLAG_VALID;
-        ch_list->ch[1].band = UMAC_BAND_5GHZ;
-        ch_list->ch[1].type = UMAC_CHANNEL_WIDTH_20MHZ;
-        ch_list->ch[1].flags = UMAC_CHANNEL_FLAG_VALID;
-        ch_list->ch[2].band = UMAC_BAND_2GHZ;
-        ch_list->ch[2].type = UMAC_CHANNEL_WIDTH_20MHZ;
-        ch_list->ch[2].flags = UMAC_CHANNEL_FLAG_VALID | UMAC_CHANNEL_FLAG_IBSS;
-        ch_list->ch[3].band = UMAC_BAND_5GHZ;
-        ch_list->ch[3].type = UMAC_CHANNEL_WIDTH_20MHZ;
-        ch_list->ch[3].flags = UMAC_CHANNEL_FLAG_VALID | UMAC_CHANNEL_FLAG_IBSS;
-        ch_list->count = cpu_to_le16(4);
-        umac_cmd.id = UMAC_CMD_OPCODE_GET_CHAN_INFO_LIST;
-        umac_cmd.resp = 1;
-        ret = iwm_hal_send_umac_cmd(iwm, &udma_cmd, &umac_cmd, ch_list, size);
-        kfree(ch_list);
-        return ret;
-}
-int iwm_scan_ssids(struct iwm_priv *iwm, struct cfg80211_ssid *ssids,
-                   int ssid_num)
-{
-        struct iwm_umac_cmd_scan_request req;
-        int i, ret;
-        memset(&req, 0, sizeof(struct iwm_umac_cmd_scan_request));
-        req.hdr.oid = UMAC_WIFI_IF_CMD_SCAN_REQUEST;
-        req.hdr.buf_size = cpu_to_le16(sizeof(struct iwm_umac_cmd_scan_request)
-                                       - sizeof(struct iwm_umac_wifi_if));
-        req.type = UMAC_WIFI_IF_SCAN_TYPE_USER;
-        req.timeout = 2;
-        req.seq_num = iwm->scan_id;
-        req.ssid_num = min(ssid_num, UMAC_WIFI_IF_PROBE_OPTION_MAX);
-        for (i = 0; i < req.ssid_num; i++) {
-                memcpy(req.ssids[i].ssid, ssids[i].ssid, ssids[i].ssid_len);
-                req.ssids[i].ssid_len = ssids[i].ssid_len;
-        }
-        ret = iwm_send_wifi_if_cmd(iwm, &req, sizeof(req), 0);
-        if (ret) {
-                IWM_ERR(iwm, "Couldn't send scan request\n");
-                return ret;
-        }
-        iwm->scan_id = (iwm->scan_id + 1) % IWM_SCAN_ID_MAX;
-        return 0;
-}
-int iwm_scan_one_ssid(struct iwm_priv *iwm, u8 *ssid, int ssid_len)
-{
-        struct cfg80211_ssid one_ssid;
-        if (test_and_set_bit(IWM_STATUS_SCANNING, &iwm->status))
-                return 0;
-        one_ssid.ssid_len = min(ssid_len, IEEE80211_MAX_SSID_LEN);
-        memcpy(&one_ssid.ssid, ssid, one_ssid.ssid_len);
-        return iwm_scan_ssids(iwm, &one_ssid, 1);
-}
-int iwm_target_reset(struct iwm_priv *iwm)
-{
-        struct iwm_udma_nonwifi_cmd target_cmd;
-        target_cmd.opcode = UMAC_HDI_OUT_OPCODE_REBOOT;
-        target_cmd.addr = 0;
-        target_cmd.op1_sz = 0;
-        target_cmd.op2 = 0;
-        target_cmd.handle_by_hw = 0;
-        target_cmd.resp = 0;
-        target_cmd.eop = 1;
-        return iwm_hal_send_target_cmd(iwm, &target_cmd, NULL);
-}
-int iwm_send_umac_stop_resume_tx(struct iwm_priv *iwm,
-                                 struct iwm_umac_notif_stop_resume_tx *ntf)
-{
-        struct iwm_udma_wifi_cmd udma_cmd = UDMA_UMAC_INIT;
-        struct iwm_umac_cmd umac_cmd;
-        struct iwm_umac_cmd_stop_resume_tx stp_res_cmd;
-        struct iwm_sta_info *sta_info;
-        u8 sta_id = STA_ID_N_COLOR_ID(ntf->sta_id);
-        int i;
-        sta_info = &iwm->sta_table[sta_id];
-        if (!sta_info->valid) {
-                IWM_ERR(iwm, "Invalid STA: %d\n", sta_id);
-                return -EINVAL;
-        }
-        umac_cmd.id = UMAC_CMD_OPCODE_STOP_RESUME_STA_TX;
-        umac_cmd.resp = 0;
-        stp_res_cmd.flags = ntf->flags;
-        stp_res_cmd.sta_id = ntf->sta_id;
-        stp_res_cmd.stop_resume_tid_msk = ntf->stop_resume_tid_msk;
-        for (i = 0; i < IWM_UMAC_TID_NR; i++)
-                stp_res_cmd.last_seq_num[i] =
-                        sta_info->tid_info[i].last_seq_num;
-        return iwm_hal_send_umac_cmd(iwm, &udma_cmd, &umac_cmd, &stp_res_cmd,
-                                 sizeof(struct iwm_umac_cmd_stop_resume_tx));
-}
-int iwm_send_pmkid_update(struct iwm_priv *iwm,
-                          struct cfg80211_pmksa *pmksa, u32 command)
-{
-        struct iwm_umac_pmkid_update update;
-        int ret;
-        memset(&update, 0, sizeof(struct iwm_umac_pmkid_update));
-        update.hdr.oid = UMAC_WIFI_IF_CMD_PMKID_UPDATE;
-        update.hdr.buf_size = cpu_to_le16(sizeof(struct iwm_umac_pmkid_update) -
-                                          sizeof(struct iwm_umac_wifi_if));
-        update.command = cpu_to_le32(command);
-        if (pmksa->bssid)
-                memcpy(&update.bssid, pmksa->bssid, ETH_ALEN);
-        if (pmksa->pmkid)
-                memcpy(&update.pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
-        ret = iwm_send_wifi_if_cmd(iwm, &update,
-                                   sizeof(struct iwm_umac_pmkid_update), 0);
-        if (ret) {
-                IWM_ERR(iwm, "PMKID update command failed\n");
-                return ret;
-        }
-        return 0;
-}
diff --git a/drivers/net/wireless/iwmc3200wifi/commands.h b/drivers/net/wireless/iwmc3200wifi/commands.h
deleted file mode 100644
index 6421689f5e8e..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/commands.h
+++ /dev/null
@@ -1,509 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- */
-#ifndef __IWM_COMMANDS_H__
-#define __IWM_COMMANDS_H__
-#include <linux/ieee80211.h>
-#define IWM_BARKER_REBOOT_NOTIFICATION  0xF
-#define IWM_ACK_BARKER_NOTIFICATION     0x10
-/* UMAC commands */
-#define UMAC_RST_CTRL_FLG_LARC_CLK_EN   0x0001
-#define UMAC_RST_CTRL_FLG_LARC_RESET    0x0002
-#define UMAC_RST_CTRL_FLG_FUNC_RESET    0x0004
-#define UMAC_RST_CTRL_FLG_DEV_RESET     0x0008
-#define UMAC_RST_CTRL_FLG_WIFI_CORE_EN  0x0010
-#define UMAC_RST_CTRL_FLG_WIFI_LINK_EN  0x0040
-#define UMAC_RST_CTRL_FLG_WIFI_MLME_EN  0x0080
-#define UMAC_RST_CTRL_FLG_NVM_RELOAD    0x0100
-struct iwm_umac_cmd_reset {
-        __le32 flags;
-} __packed;
-#define UMAC_PARAM_TBL_ORD_FIX    0x0
-#define UMAC_PARAM_TBL_ORD_VAR    0x1
-#define UMAC_PARAM_TBL_CFG_FIX    0x2
-#define UMAC_PARAM_TBL_CFG_VAR    0x3
-#define UMAC_PARAM_TBL_BSS_TRK    0x4
-#define UMAC_PARAM_TBL_FA_CFG_FIX 0x5
-#define UMAC_PARAM_TBL_STA        0x6
-#define UMAC_PARAM_TBL_CHN        0x7
-#define UMAC_PARAM_TBL_STATISTICS 0x8
-/* fast access table */
-enum {
-        CFG_FRAG_THRESHOLD = 0,
-        CFG_FRAME_RETRY_LIMIT,
-        CFG_OS_QUEUE_UTIL_TH,
-        CFG_RX_FILTER,
-        /* <-- LAST --> */
-        FAST_ACCESS_CFG_TBL_FIX_LAST
-};
-/* fixed size table */
-enum {
-        CFG_POWER_INDEX = 0,
-        CFG_PM_LEGACY_RX_TIMEOUT,
-        CFG_PM_LEGACY_TX_TIMEOUT,
-        CFG_PM_CTRL_FLAGS,
-        CFG_PM_KEEP_ALIVE_IN_BEACONS,
-        CFG_BT_ON_THRESHOLD,
-        CFG_RTS_THRESHOLD,
-        CFG_CTS_TO_SELF,
-        CFG_COEX_MODE,
-        CFG_WIRELESS_MODE,
-        CFG_ASSOCIATION_TIMEOUT,
-        CFG_ROAM_TIMEOUT,
-        CFG_CAPABILITY_SUPPORTED_RATES,
-        CFG_SCAN_ALLOWED_UNASSOC_FLAGS,
-        CFG_SCAN_ALLOWED_MAIN_ASSOC_FLAGS,
-        CFG_SCAN_ALLOWED_PAN_ASSOC_FLAGS,
-        CFG_SCAN_INTERNAL_PERIODIC_ENABLED,
-        CFG_SCAN_IMM_INTERNAL_PERIODIC_SCAN_ON_INIT,
-        CFG_SCAN_DEFAULT_PERIODIC_FREQ_SEC,
-        CFG_SCAN_NUM_PASSIVE_CHAN_PER_PARTIAL_SCAN,
-        CFG_TLC_SUPPORTED_TX_HT_RATES,
-        CFG_TLC_SUPPORTED_TX_RATES,
-        CFG_TLC_SPATIAL_STREAM_SUPPORTED,
-        CFG_TLC_RETRY_PER_RATE,
-        CFG_TLC_RETRY_PER_HT_RATE,
-        CFG_TLC_FIXED_MCS,
-        CFG_TLC_CONTROL_FLAGS,
-        CFG_TLC_SR_MIN_FAIL,
-        CFG_TLC_SR_MIN_PASS,
-        CFG_TLC_HT_STAY_IN_COL_PASS_THRESH,
-        CFG_TLC_HT_STAY_IN_COL_FAIL_THRESH,
-        CFG_TLC_LEGACY_STAY_IN_COL_PASS_THRESH,
-        CFG_TLC_LEGACY_STAY_IN_COL_FAIL_THRESH,
-        CFG_TLC_HT_FLUSH_STATS_PACKETS,
-        CFG_TLC_LEGACY_FLUSH_STATS_PACKETS,
-        CFG_TLC_LEGACY_FLUSH_STATS_MS,
-        CFG_TLC_HT_FLUSH_STATS_MS,
-        CFG_TLC_STAY_IN_COL_TIME_OUT,
-        CFG_TLC_AGG_SHORT_LIM,
-        CFG_TLC_AGG_LONG_LIM,
-        CFG_TLC_HT_SR_NO_DECREASE,
-        CFG_TLC_LEGACY_SR_NO_DECREASE,
-        CFG_TLC_SR_FORCE_DECREASE,
-        CFG_TLC_SR_ALLOW_INCREASE,
-        CFG_TLC_AGG_SET_LONG,
-        CFG_TLC_AUTO_AGGREGATION,
-        CFG_TLC_AGG_THRESHOLD,
-        CFG_TLC_TID_LOAD_THRESHOLD,
-        CFG_TLC_BLOCK_ACK_TIMEOUT,
-        CFG_TLC_NO_BA_COUNTED_AS_ONE,
-        CFG_TLC_NUM_BA_STREAMS_ALLOWED,
-        CFG_TLC_NUM_BA_STREAMS_PRESENT,
-        CFG_TLC_RENEW_ADDBA_DELAY,
-        CFG_TLC_NUM_OF_MULTISEC_TO_COUN_LOAD,
-        CFG_TLC_IS_STABLE_IN_HT,
-        CFG_TLC_SR_SIC_1ST_FAIL,
-        CFG_TLC_SR_SIC_1ST_PASS,
-        CFG_TLC_SR_SIC_TOTAL_FAIL,
-        CFG_TLC_SR_SIC_TOTAL_PASS,
-        CFG_RLC_CHAIN_CTRL,
-        CFG_TRK_TABLE_OP_MODE,
-        CFG_TRK_TABLE_RSSI_THRESHOLD,
-        CFG_TX_PWR_TARGET, /* Used By xVT */
-        CFG_TX_PWR_LIMIT_USR,
-        CFG_TX_PWR_LIMIT_BSS, /* 11d limit */
-        CFG_TX_PWR_LIMIT_BSS_CONSTRAINT, /* 11h constraint */
-        CFG_TX_PWR_MODE,
-        CFG_MLME_DBG_NOTIF_BLOCK,
-        CFG_BT_OFF_BECONS_INTERVALS,
-        CFG_BT_FRAG_DURATION,
-        CFG_ACTIVE_CHAINS,
-        CFG_CALIB_CTRL,
-        CFG_CAPABILITY_SUPPORTED_HT_RATES,
-        CFG_HT_MAC_PARAM_INFO,
-        CFG_MIMO_PS_MODE,
-        CFG_HT_DEFAULT_CAPABILIES_INFO,
-        CFG_LED_SC_RESOLUTION_FACTOR,
-        CFG_PTAM_ENERGY_CCK_DET_DEFAULT,
-        CFG_PTAM_CORR40_4_TH_ADD_MIN_MRC_DEFAULT,
-        CFG_PTAM_CORR40_4_TH_ADD_MIN_DEFAULT,
-        CFG_PTAM_CORR32_4_TH_ADD_MIN_MRC_DEFAULT,
-        CFG_PTAM_CORR32_4_TH_ADD_MIN_DEFAULT,
-        CFG_PTAM_CORR32_1_TH_ADD_MIN_MRC_DEFAULT,
-        CFG_PTAM_CORR32_1_TH_ADD_MIN_DEFAULT,
-        CFG_PTAM_ENERGY_CCK_DET_MIN_VAL,
-        CFG_PTAM_CORR40_4_TH_ADD_MIN_MRC_MIN_VAL,
-        CFG_PTAM_CORR40_4_TH_ADD_MIN_MIN_VAL,
-        CFG_PTAM_CORR32_4_TH_ADD_MIN_MRC_MIN_VAL,
-        CFG_PTAM_CORR32_4_TH_ADD_MIN_MIN_VAL,
-        CFG_PTAM_CORR32_1_TH_ADD_MIN_MRC_MIN_VAL,
-        CFG_PTAM_CORR32_1_TH_ADD_MIN_MIN_VAL,
-        CFG_PTAM_ENERGY_CCK_DET_MAX_VAL,
-        CFG_PTAM_CORR40_4_TH_ADD_MIN_MRC_MAX_VAL,
-        CFG_PTAM_CORR40_4_TH_ADD_MIN_MAX_VAL,
-        CFG_PTAM_CORR32_4_TH_ADD_MIN_MRC_MAX_VAL,
-        CFG_PTAM_CORR32_4_TH_ADD_MIN_MAX_VAL,
-        CFG_PTAM_CORR32_1_TH_ADD_MIN_MRC_MAX_VAL,
-        CFG_PTAM_CORR32_1_TH_ADD_MIN_MAX_VAL,
-        CFG_PTAM_ENERGY_CCK_DET_STEP_VAL,
-        CFG_PTAM_CORR40_4_TH_ADD_MIN_MRC_STEP_VAL,
-        CFG_PTAM_CORR40_4_TH_ADD_MIN_STEP_VAL,
-        CFG_PTAM_CORR32_4_TH_ADD_MIN_MRC_STEP_VAL,
-        CFG_PTAM_CORR32_4_TH_ADD_MIN_STEP_VAL,
-        CFG_PTAM_CORR32_1_TH_ADD_MIN_MRC_STEP_VAL,
-        CFG_PTAM_CORR32_1_TH_ADD_MIN_STEP_VAL,
-        CFG_PTAM_LINK_SENS_FA_OFDM_MAX,
-        CFG_PTAM_LINK_SENS_FA_OFDM_MIN,
-        CFG_PTAM_LINK_SENS_FA_CCK_MAX,
-        CFG_PTAM_LINK_SENS_FA_CCK_MIN,
-        CFG_PTAM_LINK_SENS_NRG_DIFF,
-        CFG_PTAM_LINK_SENS_NRG_MARGIN,
-        CFG_PTAM_LINK_SENS_MAX_NUMBER_OF_TIMES_IN_CCK_NO_FA,
-        CFG_PTAM_LINK_SENS_AUTO_CORR_MAX_TH_CCK,
-        CFG_AGG_MGG_TID_LOAD_ADDBA_THRESHOLD,
-        CFG_AGG_MGG_TID_LOAD_DELBA_THRESHOLD,
-        CFG_AGG_MGG_ADDBA_BUF_SIZE,
-        CFG_AGG_MGG_ADDBA_INACTIVE_TIMEOUT,
-        CFG_AGG_MGG_ADDBA_DEBUG_FLAGS,
-        CFG_SCAN_PERIODIC_RSSI_HIGH_THRESHOLD,
-        CFG_SCAN_PERIODIC_COEF_RSSI_HIGH,
-        CFG_11D_ENABLED,
-        CFG_11H_FEATURE_FLAGS,
-        /* <-- LAST --> */
-        CFG_TBL_FIX_LAST
-};
-/* variable size table */
-enum {
-        CFG_NET_ADDR = 0,
-        CFG_LED_PATTERN_TABLE,
-        /* <-- LAST --> */
-        CFG_TBL_VAR_LAST
-};
-struct iwm_umac_cmd_set_param_fix {
-        __le16 tbl;
-        __le16 key;
-        __le32 value;
-} __packed;
-struct iwm_umac_cmd_set_param_var {
-        __le16 tbl;
-        __le16 key;
-        __le16 len;
-        __le16 reserved;
-} __packed;
-struct iwm_umac_cmd_get_param {
-        __le16 tbl;
-        __le16 key;
-} __packed;
-struct iwm_umac_cmd_get_param_resp {
-        __le16 tbl;
-        __le16 key;
-        __le16 len;
-        __le16 reserved;
-} __packed;
-struct iwm_umac_cmd_eeprom_proxy_hdr {
-        __le32 type;
-        __le32 offset;
-        __le32 len;
-} __packed;
-struct iwm_umac_cmd_eeprom_proxy {
-        struct iwm_umac_cmd_eeprom_proxy_hdr hdr;
-        u8 buf[0];
-} __packed;
-#define IWM_UMAC_CMD_EEPROM_TYPE_READ       0x1
-#define IWM_UMAC_CMD_EEPROM_TYPE_WRITE      0x2
-#define UMAC_CHANNEL_FLAG_VALID         BIT(0)
-#define UMAC_CHANNEL_FLAG_IBSS          BIT(1)
-#define UMAC_CHANNEL_FLAG_ACTIVE        BIT(3)
-#define UMAC_CHANNEL_FLAG_RADAR         BIT(4)
-#define UMAC_CHANNEL_FLAG_DFS           BIT(7)
-struct iwm_umac_channel_info {
-        u8 band;
-        u8 type;
-        u8 reserved;
-        u8 flags;
-        __le32 channels_mask;
-} __packed;
-struct iwm_umac_cmd_get_channel_list {
-        __le16 count;
-        __le16 reserved;
-        struct iwm_umac_channel_info ch[0];
-} __packed;
-/* UMAC WiFi interface commands */
-/* Coexistence mode */
-#define COEX_MODE_SA  0x1
-#define COEX_MODE_XOR 0x2
-#define COEX_MODE_CM  0x3
-#define COEX_MODE_MAX 0x4
-/* Wireless mode */
-#define WIRELESS_MODE_11A  0x1
-#define WIRELESS_MODE_11G  0x2
-#define WIRELESS_MODE_11N  0x4
-#define UMAC_PROFILE_EX_IE_REQUIRED     0x1
-#define UMAC_PROFILE_QOS_ALLOWED        0x2
-/* Scanning */
-#define UMAC_WIFI_IF_PROBE_OPTION_MAX        10
-#define UMAC_WIFI_IF_SCAN_TYPE_USER          0x0
-#define UMAC_WIFI_IF_SCAN_TYPE_UMAC_RESERVED 0x1
-#define UMAC_WIFI_IF_SCAN_TYPE_HOST_PERIODIC 0x2
-#define UMAC_WIFI_IF_SCAN_TYPE_MAX           0x3
-struct iwm_umac_ssid {
-        u8 ssid_len;
-        u8 ssid[IEEE80211_MAX_SSID_LEN];
-        u8 reserved[3];
-} __packed;
-struct iwm_umac_cmd_scan_request {
-        struct iwm_umac_wifi_if hdr;
-        __le32 type; /* UMAC_WIFI_IF_SCAN_TYPE_* */
-        u8 ssid_num;
-        u8 seq_num;
-        u8 timeout; /* In seconds */
-        u8 reserved;
-        struct iwm_umac_ssid ssids[UMAC_WIFI_IF_PROBE_OPTION_MAX];
-} __packed;
-#define UMAC_CIPHER_TYPE_NONE           0xFF
-#define UMAC_CIPHER_TYPE_USE_GROUPCAST  0x00
-#define UMAC_CIPHER_TYPE_WEP_40         0x01
-#define UMAC_CIPHER_TYPE_WEP_104        0x02
-#define UMAC_CIPHER_TYPE_TKIP           0x04
-#define UMAC_CIPHER_TYPE_CCMP           0x08
-/* Supported authentication types - bitmap */
-#define UMAC_AUTH_TYPE_OPEN             0x00
-#define UMAC_AUTH_TYPE_LEGACY_PSK       0x01
-#define UMAC_AUTH_TYPE_8021X            0x02
-#define UMAC_AUTH_TYPE_RSNA_PSK         0x04
-/* iwm_umac_security.flag is WPA supported -- bits[0:0] */
-#define UMAC_SEC_FLG_WPA_ON_POS         0
-#define UMAC_SEC_FLG_WPA_ON_SEED        1
-#define UMAC_SEC_FLG_WPA_ON_MSK (UMAC_SEC_FLG_WPA_ON_SEED << \
-                                 UMAC_SEC_FLG_WPA_ON_POS)
-/* iwm_umac_security.flag is WPA2 supported -- bits [1:1] */
-#define UMAC_SEC_FLG_RSNA_ON_POS        1
-#define UMAC_SEC_FLG_RSNA_ON_SEED       1
-#define UMAC_SEC_FLG_RSNA_ON_MSK        (UMAC_SEC_FLG_RSNA_ON_SEED << \
-                                         UMAC_SEC_FLG_RSNA_ON_POS)
-/* iwm_umac_security.flag is WSC mode on -- bits [2:2] */
-#define UMAC_SEC_FLG_WSC_ON_POS         2
-#define UMAC_SEC_FLG_WSC_ON_SEED        1
-#define UMAC_SEC_FLG_WSC_ON_MSK         (UMAC_SEC_FLG_WSC_ON_SEED << \
-                                         UMAC_SEC_FLG_WSC_ON_POS)
-/* Legacy profile can use only WEP40 and WEP104 for encryption and
- * OPEN or PSK for authentication */
-#define UMAC_SEC_FLG_LEGACY_PROFILE     0
-struct iwm_umac_security {
-        u8 auth_type;
-        u8 ucast_cipher;
-        u8 mcast_cipher;
-        u8 flags;
-} __packed;
-struct iwm_umac_ibss {
-        u8 beacon_interval;     /* in millisecond */
-        u8 atim;                /* in millisecond */
-        s8 join_only;
-        u8 band;
-        u8 channel;
-        u8 reserved[3];
-} __packed;
-#define UMAC_MODE_BSS   0
-#define UMAC_MODE_IBSS  1
-#define UMAC_BSSID_MAX  4
-struct iwm_umac_profile {
-        struct iwm_umac_wifi_if hdr;
-        __le32 mode;
-        struct iwm_umac_ssid ssid;
-        u8 bssid[UMAC_BSSID_MAX][ETH_ALEN];
-        struct iwm_umac_security sec;
-        struct iwm_umac_ibss ibss;
-        __le32 channel_2ghz;
-        __le32 channel_5ghz;
-        __le16 flags;
-        u8 wireless_mode;
-        u8 bss_num;
-} __packed;
-struct iwm_umac_invalidate_profile {
-        struct iwm_umac_wifi_if hdr;
-        u8 reason;
-        u8 reserved[3];
-} __packed;
-/* Encryption key commands */
-struct iwm_umac_key_wep40 {
-        struct iwm_umac_wifi_if hdr;
-        struct iwm_umac_key_hdr key_hdr;
-        u8 key[WLAN_KEY_LEN_WEP40];
-        u8 static_key;
-        u8 reserved[2];
-} __packed;
-struct iwm_umac_key_wep104 {
-        struct iwm_umac_wifi_if hdr;
-        struct iwm_umac_key_hdr key_hdr;
-        u8 key[WLAN_KEY_LEN_WEP104];
-        u8 static_key;
-        u8 reserved[2];
-} __packed;
-#define IWM_TKIP_KEY_SIZE 16
-#define IWM_TKIP_MIC_SIZE 8
-struct iwm_umac_key_tkip {
-        struct iwm_umac_wifi_if hdr;
-        struct iwm_umac_key_hdr key_hdr;
-        u8 iv_count[6];
-        u8 reserved[2];
-        u8 tkip_key[IWM_TKIP_KEY_SIZE];
-        u8 mic_rx_key[IWM_TKIP_MIC_SIZE];
-        u8 mic_tx_key[IWM_TKIP_MIC_SIZE];
-} __packed;
-struct iwm_umac_key_ccmp {
-        struct iwm_umac_wifi_if hdr;
-        struct iwm_umac_key_hdr key_hdr;
-        u8 iv_count[6];
-        u8 reserved[2];
-        u8 key[WLAN_KEY_LEN_CCMP];
-} __packed;
-struct iwm_umac_key_remove {
-        struct iwm_umac_wifi_if hdr;
-        struct iwm_umac_key_hdr key_hdr;
-} __packed;
-struct iwm_umac_tx_key_id {
-        struct iwm_umac_wifi_if hdr;
-        u8 key_idx;
-        u8 reserved[3];
-} __packed;
-struct iwm_umac_pwr_trigger {
-        struct iwm_umac_wifi_if hdr;
-        __le32 reseved;
-} __packed;
-struct iwm_umac_cmd_stats_req {
-        __le32 flags;
-} __packed;
-struct iwm_umac_cmd_stop_resume_tx {
-        u8 flags;
-        u8 sta_id;
-        __le16 stop_resume_tid_msk;
-        __le16 last_seq_num[IWM_UMAC_TID_NR];
-        u16 reserved;
-} __packed;
-#define IWM_CMD_PMKID_ADD   1
-#define IWM_CMD_PMKID_DEL   2
-#define IWM_CMD_PMKID_FLUSH 3
-struct iwm_umac_pmkid_update {
-        struct iwm_umac_wifi_if hdr;
-        __le32 command;
-        u8 bssid[ETH_ALEN];
-        __le16 reserved;
-        u8 pmkid[WLAN_PMKID_LEN];
-} __packed;
-/* LMAC commands */
-int iwm_read_mac(struct iwm_priv *iwm, u8 *mac);
-int iwm_send_prio_table(struct iwm_priv *iwm);
-int iwm_send_init_calib_cfg(struct iwm_priv *iwm, u8 calib_requested);
-int iwm_send_periodic_calib_cfg(struct iwm_priv *iwm, u8 calib_requested);
-int iwm_send_calib_results(struct iwm_priv *iwm);
-int iwm_store_rxiq_calib_result(struct iwm_priv *iwm);
-int iwm_send_ct_kill_cfg(struct iwm_priv *iwm, u8 entry, u8 exit);
-/* UMAC commands */
-int iwm_send_wifi_if_cmd(struct iwm_priv *iwm, void *payload, u16 payload_size,
-                         bool resp);
-int iwm_send_umac_reset(struct iwm_priv *iwm, __le32 reset_flags, bool resp);
-int iwm_umac_set_config_fix(struct iwm_priv *iwm, u16 tbl, u16 key, u32 value);
-int iwm_umac_set_config_var(struct iwm_priv *iwm, u16 key,
-                            void *payload, u16 payload_size);
-int iwm_send_umac_config(struct iwm_priv *iwm, __le32 reset_flags);
-int iwm_send_mlme_profile(struct iwm_priv *iwm);
-int __iwm_invalidate_mlme_profile(struct iwm_priv *iwm);
-int iwm_invalidate_mlme_profile(struct iwm_priv *iwm);
-int iwm_send_packet(struct iwm_priv *iwm, struct sk_buff *skb, int pool_id);
-int iwm_set_tx_key(struct iwm_priv *iwm, u8 key_idx);
-int iwm_set_key(struct iwm_priv *iwm, bool remove, struct iwm_key *key);
-int iwm_tx_power_trigger(struct iwm_priv *iwm);
-int iwm_send_umac_stats_req(struct iwm_priv *iwm, u32 flags);
-int iwm_send_umac_channel_list(struct iwm_priv *iwm);
-int iwm_scan_ssids(struct iwm_priv *iwm, struct cfg80211_ssid *ssids,
-                   int ssid_num);
-int iwm_scan_one_ssid(struct iwm_priv *iwm, u8 *ssid, int ssid_len);
-int iwm_send_umac_stop_resume_tx(struct iwm_priv *iwm,
-                                 struct iwm_umac_notif_stop_resume_tx *ntf);
-int iwm_send_pmkid_update(struct iwm_priv *iwm,
-                          struct cfg80211_pmksa *pmksa, u32 command);
-/* UDMA commands */
-int iwm_target_reset(struct iwm_priv *iwm);
-#endif
diff --git a/drivers/net/wireless/iwmc3200wifi/debug.h b/drivers/net/wireless/iwmc3200wifi/debug.h
deleted file mode 100644
index a0c13a49ab3c..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/debug.h
+++ /dev/null
@@ -1,123 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version
- * 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- *
- */
-#ifndef __IWM_DEBUG_H__
-#define __IWM_DEBUG_H__
-#define IWM_ERR(p, f, a...) dev_err(iwm_to_dev(p), f, ## a)
-#define IWM_WARN(p, f, a...) dev_warn(iwm_to_dev(p), f, ## a)
-#define IWM_INFO(p, f, a...) dev_info(iwm_to_dev(p), f, ## a)
-#define IWM_CRIT(p, f, a...) dev_crit(iwm_to_dev(p), f, ## a)
-#ifdef CONFIG_IWM_DEBUG
-#define IWM_DEBUG_MODULE(i, level, module, f, a...)                          \
-do {                                                                         \
-        if (unlikely(i->dbg.dbg_module[IWM_DM_##module] >= (IWM_DL_##level)))\
-                dev_printk(KERN_INFO, (iwm_to_dev(i)),               \
-                           "%s " f, __func__ , ## a);                        \
-} while (0)
-#define IWM_HEXDUMP(i, level, module, pref, buf, len)                        \
-do {                                                                         \
-        if (unlikely(i->dbg.dbg_module[IWM_DM_##module] >= (IWM_DL_##level)))\
-                print_hex_dump(KERN_INFO, pref, DUMP_PREFIX_OFFSET,          \
-                               16, 1, buf, len, 1);                          \
-} while (0)
-#else
-#define IWM_DEBUG_MODULE(i, level, module, f, a...)
-#define IWM_HEXDUMP(i, level, module, pref, buf, len)
-#endif /* CONFIG_IWM_DEBUG */
-/* Debug modules */
-enum iwm_debug_module_id {
-        IWM_DM_BOOT = 0,
-        IWM_DM_FW,
-        IWM_DM_SDIO,
-        IWM_DM_NTF,
-        IWM_DM_RX,
-        IWM_DM_TX,
-        IWM_DM_MLME,
-        IWM_DM_CMD,
-        IWM_DM_WEXT,
-        __IWM_DM_NR,
-};
-#define IWM_DM_DEFAULT 0
-#define IWM_DBG_BOOT(i, l, f, a...) IWM_DEBUG_MODULE(i, l, BOOT, f, ## a)
-#define IWM_DBG_FW(i, l, f, a...)   IWM_DEBUG_MODULE(i, l, FW, f, ## a)
-#define IWM_DBG_SDIO(i, l, f, a...) IWM_DEBUG_MODULE(i, l, SDIO, f, ## a)
-#define IWM_DBG_NTF(i, l, f, a...)  IWM_DEBUG_MODULE(i, l, NTF, f, ## a)
-#define IWM_DBG_RX(i, l, f, a...)   IWM_DEBUG_MODULE(i, l, RX, f, ## a)
-#define IWM_DBG_TX(i, l, f, a...)   IWM_DEBUG_MODULE(i, l, TX, f, ## a)
-#define IWM_DBG_MLME(i, l, f, a...) IWM_DEBUG_MODULE(i, l, MLME, f, ## a)
-#define IWM_DBG_CMD(i, l, f, a...)  IWM_DEBUG_MODULE(i, l, CMD, f, ## a)
-#define IWM_DBG_WEXT(i, l, f, a...) IWM_DEBUG_MODULE(i, l, WEXT, f, ## a)
-/* Debug levels */
-enum iwm_debug_level {
-        IWM_DL_NONE = 0,
-        IWM_DL_ERR,
-        IWM_DL_WARN,
-        IWM_DL_INFO,
-        IWM_DL_DBG,
-};
-#define IWM_DL_DEFAULT IWM_DL_ERR
-struct iwm_debugfs {
-        struct iwm_priv *iwm;
-        struct dentry *rootdir;
-        struct dentry *devdir;
-        struct dentry *dbgdir;
-        struct dentry *txdir;
-        struct dentry *rxdir;
-        struct dentry *busdir;
-        u32 dbg_level;
-        struct dentry *dbg_level_dentry;
-        unsigned long dbg_modules;
-        struct dentry *dbg_modules_dentry;
-        u8 dbg_module[__IWM_DM_NR];
-        struct dentry *dbg_module_dentries[__IWM_DM_NR];
-        struct dentry *txq_dentry;
-        struct dentry *tx_credit_dentry;
-        struct dentry *rx_ticket_dentry;
-        struct dentry *fw_err_dentry;
-};
-#ifdef CONFIG_IWM_DEBUG
-void iwm_debugfs_init(struct iwm_priv *iwm);
-void iwm_debugfs_exit(struct iwm_priv *iwm);
-#else
-static inline void iwm_debugfs_init(struct iwm_priv *iwm) {}
-static inline void iwm_debugfs_exit(struct iwm_priv *iwm) {}
-#endif
-#endif
diff --git a/drivers/net/wireless/iwmc3200wifi/debugfs.c b/drivers/net/wireless/iwmc3200wifi/debugfs.c
deleted file mode 100644
index b6199d124bb9..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/debugfs.c
+++ /dev/null
@@ -1,488 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version
- * 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- *
- */
-#include <linux/slab.h>
-#include <linux/kernel.h>
-#include <linux/bitops.h>
-#include <linux/debugfs.h>
-#include <linux/export.h>
-#include "iwm.h"
-#include "bus.h"
-#include "rx.h"
-#include "debug.h"
-static struct {
-        u8 id;
-        char *name;
-} iwm_debug_module[__IWM_DM_NR] = {
-         {IWM_DM_BOOT, "boot"},
-         {IWM_DM_FW,   "fw"},
-         {IWM_DM_SDIO, "sdio"},
-         {IWM_DM_NTF,  "ntf"},
-         {IWM_DM_RX,   "rx"},
-         {IWM_DM_TX,   "tx"},
-         {IWM_DM_MLME, "mlme"},
-         {IWM_DM_CMD,  "cmd"},
-         {IWM_DM_WEXT,  "wext"},
-};
-#define add_dbg_module(dbg, name, id, initlevel)        \
-do {                                                    \
-        dbg.dbg_module[id] = (initlevel);               \
-        dbg.dbg_module_dentries[id] =                   \
-                debugfs_create_x8(name, 0600,           \
-                                dbg.dbgdir,             \
-                                &(dbg.dbg_module[id])); \
-} while (0)
-static int iwm_debugfs_u32_read(void *data, u64 *val)
-{
-        struct iwm_priv *iwm = data;
-        *val = iwm->dbg.dbg_level;
-        return 0;
-}
-static int iwm_debugfs_dbg_level_write(void *data, u64 val)
-{
-        struct iwm_priv *iwm = data;
-        int i;
-        iwm->dbg.dbg_level = val;
-        for (i = 0; i < __IWM_DM_NR; i++)
-                iwm->dbg.dbg_module[i] = val;
-        return 0;
-}
-DEFINE_SIMPLE_ATTRIBUTE(fops_iwm_dbg_level,
-                        iwm_debugfs_u32_read, iwm_debugfs_dbg_level_write,
-                        "%llu\n");
-static int iwm_debugfs_dbg_modules_write(void *data, u64 val)
-{
-        struct iwm_priv *iwm = data;
-        int i, bit;
-        iwm->dbg.dbg_modules = val;
-        for (i = 0; i < __IWM_DM_NR; i++)
-                iwm->dbg.dbg_module[i] = 0;
-        for_each_set_bit(bit, &iwm->dbg.dbg_modules, __IWM_DM_NR)
-                iwm->dbg.dbg_module[bit] = iwm->dbg.dbg_level;
-        return 0;
-}
-DEFINE_SIMPLE_ATTRIBUTE(fops_iwm_dbg_modules,
-                        iwm_debugfs_u32_read, iwm_debugfs_dbg_modules_write,
-                        "%llu\n");
-static ssize_t iwm_debugfs_txq_read(struct file *filp, char __user *buffer,
-                                   size_t count, loff_t *ppos)
-{
-        struct iwm_priv *iwm = filp->private_data;
-        char *buf;
-        int i, buf_len = 4096;
-        size_t len = 0;
-        ssize_t ret;
-        if (*ppos != 0)
-                return 0;
-        if (count < sizeof(buf))
-                return -ENOSPC;
-        buf = kzalloc(buf_len, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-        for (i = 0; i < IWM_TX_QUEUES; i++) {
-                struct iwm_tx_queue *txq = &iwm->txq[i];
-                struct sk_buff *skb;
-                int j;
-                unsigned long flags;
-                spin_lock_irqsave(&txq->queue.lock, flags);
-                skb = (struct sk_buff *)&txq->queue;
-                len += snprintf(buf + len, buf_len - len, "TXQ #%d\n", i);
-                len += snprintf(buf + len, buf_len - len, "\tStopped:     %d\n",
-                                __netif_subqueue_stopped(iwm_to_ndev(iwm),
-                                                         txq->id));
-                len += snprintf(buf + len, buf_len - len, "\tConcat count:%d\n",
-                                txq->concat_count);
-                len += snprintf(buf + len, buf_len - len, "\tQueue len:   %d\n",
-                                skb_queue_len(&txq->queue));
-                for (j = 0; j < skb_queue_len(&txq->queue); j++) {
-                        struct iwm_tx_info *tx_info;
-                        skb = skb->next;
-                        tx_info = skb_to_tx_info(skb);
-                        len += snprintf(buf + len, buf_len - len,
-                                        "\tSKB #%d\n", j);
-                        len += snprintf(buf + len, buf_len - len,
-                                        "\t\tsta:   %d\n", tx_info->sta);
-                        len += snprintf(buf + len, buf_len - len,
-                                        "\t\tcolor: %d\n", tx_info->color);
-                        len += snprintf(buf + len, buf_len - len,
-                                        "\t\ttid:   %d\n", tx_info->tid);
-                }
-                spin_unlock_irqrestore(&txq->queue.lock, flags);
-                spin_lock_irqsave(&txq->stopped_queue.lock, flags);
-                len += snprintf(buf + len, buf_len - len,
-                                "\tStopped Queue len:   %d\n",
-                                skb_queue_len(&txq->stopped_queue));
-                for (j = 0; j < skb_queue_len(&txq->stopped_queue); j++) {
-                        struct iwm_tx_info *tx_info;
-                        skb = skb->next;
-                        tx_info = skb_to_tx_info(skb);
-                        len += snprintf(buf + len, buf_len - len,
-                                        "\tSKB #%d\n", j);
-                        len += snprintf(buf + len, buf_len - len,
-                                        "\t\tsta:   %d\n", tx_info->sta);
-                        len += snprintf(buf + len, buf_len - len,
-                                        "\t\tcolor: %d\n", tx_info->color);
-                        len += snprintf(buf + len, buf_len - len,
-                                        "\t\ttid:   %d\n", tx_info->tid);
-                }
-                spin_unlock_irqrestore(&txq->stopped_queue.lock, flags);
-        }
-        ret = simple_read_from_buffer(buffer, len, ppos, buf, buf_len);
-        kfree(buf);
-        return ret;
-}
-static ssize_t iwm_debugfs_tx_credit_read(struct file *filp,
-                                          char __user *buffer,
-                                          size_t count, loff_t *ppos)
-{
-        struct iwm_priv *iwm = filp->private_data;
-        struct iwm_tx_credit *credit = &iwm->tx_credit;
-        char *buf;
-        int i, buf_len = 4096;
-        size_t len = 0;
-        ssize_t ret;
-        if (*ppos != 0)
-                return 0;
-        if (count < sizeof(buf))
-                return -ENOSPC;
-        buf = kzalloc(buf_len, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-        len += snprintf(buf + len, buf_len - len,
-                        "NR pools:  %d\n", credit->pool_nr);
-        len += snprintf(buf + len, buf_len - len,
-                        "pools map: 0x%lx\n", credit->full_pools_map);
-        len += snprintf(buf + len, buf_len - len, "\n### POOLS ###\n");
-        for (i = 0; i < IWM_MACS_OUT_GROUPS; i++) {
-                len += snprintf(buf + len, buf_len - len,
-                                "pools entry #%d\n", i);
-                len += snprintf(buf + len, buf_len - len,
-                                "\tid:          %d\n",
-                                credit->pools[i].id);
-                len += snprintf(buf + len, buf_len - len,
-                                "\tsid:         %d\n",
-                                credit->pools[i].sid);
-                len += snprintf(buf + len, buf_len - len,
-                                "\tmin_pages:   %d\n",
-                                credit->pools[i].min_pages);
-                len += snprintf(buf + len, buf_len - len,
-                                "\tmax_pages:   %d\n",
-                                credit->pools[i].max_pages);
-                len += snprintf(buf + len, buf_len - len,
-                                "\talloc_pages: %d\n",
-                                credit->pools[i].alloc_pages);
-                len += snprintf(buf + len, buf_len - len,
-                                "\tfreed_pages: %d\n",
-                                credit->pools[i].total_freed_pages);
-        }
-        len += snprintf(buf + len, buf_len - len, "\n### SPOOLS ###\n");
-        for (i = 0; i < IWM_MACS_OUT_SGROUPS; i++) {
-                len += snprintf(buf + len, buf_len - len,
-                                "spools entry #%d\n", i);
-                len += snprintf(buf + len, buf_len - len,
-                                "\tid:          %d\n",
-                                credit->spools[i].id);
-                len += snprintf(buf + len, buf_len - len,
-                                "\tmax_pages:   %d\n",
-                                credit->spools[i].max_pages);
-                len += snprintf(buf + len, buf_len - len,
-                                "\talloc_pages: %d\n",
-                                credit->spools[i].alloc_pages);
-        }
-        ret = simple_read_from_buffer(buffer, len, ppos, buf, buf_len);
-        kfree(buf);
-        return ret;
-}
-static ssize_t iwm_debugfs_rx_ticket_read(struct file *filp,
-                                          char __user *buffer,
-                                          size_t count, loff_t *ppos)
-{
-        struct iwm_priv *iwm = filp->private_data;
-        struct iwm_rx_ticket_node *ticket;
-        char *buf;
-        int buf_len = 4096, i;
-        size_t len = 0;
-        ssize_t ret;
-        if (*ppos != 0)
-                return 0;
-        if (count < sizeof(buf))
-                return -ENOSPC;
-        buf = kzalloc(buf_len, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-        spin_lock(&iwm->ticket_lock);
-        list_for_each_entry(ticket, &iwm->rx_tickets, node) {
-                len += snprintf(buf + len, buf_len - len, "Ticket #%d\n",
-                                ticket->ticket->id);
-                len += snprintf(buf + len, buf_len - len, "\taction: 0x%x\n",
-                                ticket->ticket->action);
-                len += snprintf(buf + len, buf_len - len, "\tflags:  0x%x\n",
-                                ticket->ticket->flags);
-        }
-        spin_unlock(&iwm->ticket_lock);
-        for (i = 0; i < IWM_RX_ID_HASH; i++) {
-                struct iwm_rx_packet *packet;
-                struct list_head *pkt_list = &iwm->rx_packets[i];
-                if (!list_empty(pkt_list)) {
-                        len += snprintf(buf + len, buf_len - len,
-                                        "Packet hash #%d\n", i);
-                        spin_lock(&iwm->packet_lock[i]);
-                        list_for_each_entry(packet, pkt_list, node) {
-                                len += snprintf(buf + len, buf_len - len,
-                                                "\tPacket id:     %d\n",
-                                                packet->id);
-                                len += snprintf(buf + len, buf_len - len,
-                                                "\tPacket length: %lu\n",
-                                                packet->pkt_size);
-                        }
-                        spin_unlock(&iwm->packet_lock[i]);
-                }
-        }
-        ret = simple_read_from_buffer(buffer, len, ppos, buf, buf_len);
-        kfree(buf);
-        return ret;
-}
-static ssize_t iwm_debugfs_fw_err_read(struct file *filp,
-                                       char __user *buffer,
-                                       size_t count, loff_t *ppos)
-{
-        struct iwm_priv *iwm = filp->private_data;
-        char buf[512];
-        int buf_len = 512;
-        size_t len = 0;
-        if (*ppos != 0)
-                return 0;
-        if (count < sizeof(buf))
-                return -ENOSPC;
-        if (!iwm->last_fw_err)
-                return -ENOMEM;
-        if (iwm->last_fw_err->line_num == 0)
-                goto out;
-        len += snprintf(buf + len, buf_len - len, "%cMAC FW ERROR:\n",
-             (le32_to_cpu(iwm->last_fw_err->category) == UMAC_SYS_ERR_CAT_LMAC)
-                        ? 'L' : 'U');
-        len += snprintf(buf + len, buf_len - len,
-                        "\tCategory:    %d\n",
-                        le32_to_cpu(iwm->last_fw_err->category));
-        len += snprintf(buf + len, buf_len - len,
-                        "\tStatus:      0x%x\n",
-                        le32_to_cpu(iwm->last_fw_err->status));
-        len += snprintf(buf + len, buf_len - len,
-                        "\tPC:          0x%x\n",
-                        le32_to_cpu(iwm->last_fw_err->pc));
-        len += snprintf(buf + len, buf_len - len,
-                        "\tblink1:      %d\n",
-                        le32_to_cpu(iwm->last_fw_err->blink1));
-        len += snprintf(buf + len, buf_len - len,
-                        "\tblink2:      %d\n",
-                        le32_to_cpu(iwm->last_fw_err->blink2));
-        len += snprintf(buf + len, buf_len - len,
-                        "\tilink1:      %d\n",
-                        le32_to_cpu(iwm->last_fw_err->ilink1));
-        len += snprintf(buf + len, buf_len - len,
-                        "\tilink2:      %d\n",
-                        le32_to_cpu(iwm->last_fw_err->ilink2));
-        len += snprintf(buf + len, buf_len - len,
-                        "\tData1:       0x%x\n",
-                        le32_to_cpu(iwm->last_fw_err->data1));
-        len += snprintf(buf + len, buf_len - len,
-                        "\tData2:       0x%x\n",
-                        le32_to_cpu(iwm->last_fw_err->data2));
-        len += snprintf(buf + len, buf_len - len,
-                        "\tLine number: %d\n",
-                        le32_to_cpu(iwm->last_fw_err->line_num));
-        len += snprintf(buf + len, buf_len - len,
-                        "\tUMAC status: 0x%x\n",
-                        le32_to_cpu(iwm->last_fw_err->umac_status));
-        len += snprintf(buf + len, buf_len - len,
-                        "\tLMAC status: 0x%x\n",
-                        le32_to_cpu(iwm->last_fw_err->lmac_status));
-        len += snprintf(buf + len, buf_len - len,
-                        "\tSDIO status: 0x%x\n",
-                        le32_to_cpu(iwm->last_fw_err->sdio_status));
-out:
-        return simple_read_from_buffer(buffer, len, ppos, buf, buf_len);
-}
-static const struct file_operations iwm_debugfs_txq_fops = {
-        .owner =        THIS_MODULE,
-        .open =         simple_open,
-        .read =         iwm_debugfs_txq_read,
-        .llseek =       default_llseek,
-};
-static const struct file_operations iwm_debugfs_tx_credit_fops = {
-        .owner =        THIS_MODULE,
-        .open =         simple_open,
-        .read =         iwm_debugfs_tx_credit_read,
-        .llseek =       default_llseek,
-};
-static const struct file_operations iwm_debugfs_rx_ticket_fops = {
-        .owner =        THIS_MODULE,
-        .open =         simple_open,
-        .read =         iwm_debugfs_rx_ticket_read,
-        .llseek =       default_llseek,
-};
-static const struct file_operations iwm_debugfs_fw_err_fops = {
-        .owner =        THIS_MODULE,
-        .open =         simple_open,
-        .read =         iwm_debugfs_fw_err_read,
-        .llseek =       default_llseek,
-};
-void iwm_debugfs_init(struct iwm_priv *iwm)
-{
-        int i;
-        iwm->dbg.rootdir = debugfs_create_dir(KBUILD_MODNAME, NULL);
-        iwm->dbg.devdir = debugfs_create_dir(wiphy_name(iwm_to_wiphy(iwm)),
-                                             iwm->dbg.rootdir);
-        iwm->dbg.dbgdir = debugfs_create_dir("debug", iwm->dbg.devdir);
-        iwm->dbg.rxdir = debugfs_create_dir("rx", iwm->dbg.devdir);
-        iwm->dbg.txdir = debugfs_create_dir("tx", iwm->dbg.devdir);
-        iwm->dbg.busdir = debugfs_create_dir("bus", iwm->dbg.devdir);
-        if (iwm->bus_ops->debugfs_init)
-                iwm->bus_ops->debugfs_init(iwm, iwm->dbg.busdir);
-        iwm->dbg.dbg_level = IWM_DL_NONE;
-        iwm->dbg.dbg_level_dentry =
-                debugfs_create_file("level", 0200, iwm->dbg.dbgdir, iwm,
-                                    &fops_iwm_dbg_level);
-        iwm->dbg.dbg_modules = IWM_DM_DEFAULT;
-        iwm->dbg.dbg_modules_dentry =
-                debugfs_create_file("modules", 0200, iwm->dbg.dbgdir, iwm,
-                                    &fops_iwm_dbg_modules);
-        for (i = 0; i < __IWM_DM_NR; i++)
-                add_dbg_module(iwm->dbg, iwm_debug_module[i].name,
-                               iwm_debug_module[i].id, IWM_DL_DEFAULT);
-        iwm->dbg.txq_dentry = debugfs_create_file("queues", 0200,
-                                                  iwm->dbg.txdir, iwm,
-                                                  &iwm_debugfs_txq_fops);
-        iwm->dbg.tx_credit_dentry = debugfs_create_file("credits", 0200,
-                                                   iwm->dbg.txdir, iwm,
-                                                   &iwm_debugfs_tx_credit_fops);
-        iwm->dbg.rx_ticket_dentry = debugfs_create_file("tickets", 0200,
-                                                  iwm->dbg.rxdir, iwm,
-                                                  &iwm_debugfs_rx_ticket_fops);
-        iwm->dbg.fw_err_dentry = debugfs_create_file("last_fw_err", 0200,
-                                                     iwm->dbg.dbgdir, iwm,
-                                                     &iwm_debugfs_fw_err_fops);
-}
-void iwm_debugfs_exit(struct iwm_priv *iwm)
-{
-        int i;
-        for (i = 0; i < __IWM_DM_NR; i++)
-                debugfs_remove(iwm->dbg.dbg_module_dentries[i]);
-        debugfs_remove(iwm->dbg.dbg_modules_dentry);
-        debugfs_remove(iwm->dbg.dbg_level_dentry);
-        debugfs_remove(iwm->dbg.txq_dentry);
-        debugfs_remove(iwm->dbg.tx_credit_dentry);
-        debugfs_remove(iwm->dbg.rx_ticket_dentry);
-        debugfs_remove(iwm->dbg.fw_err_dentry);
-        if (iwm->bus_ops->debugfs_exit)
-                iwm->bus_ops->debugfs_exit(iwm);
-        debugfs_remove(iwm->dbg.busdir);
-        debugfs_remove(iwm->dbg.dbgdir);
-        debugfs_remove(iwm->dbg.txdir);
-        debugfs_remove(iwm->dbg.rxdir);
-        debugfs_remove(iwm->dbg.devdir);
-        debugfs_remove(iwm->dbg.rootdir);
-}
diff --git a/drivers/net/wireless/iwmc3200wifi/eeprom.c b/drivers/net/wireless/iwmc3200wifi/eeprom.c
deleted file mode 100644
index e80e776b74f7..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/eeprom.c
+++ /dev/null
@@ -1,234 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- */
-#include <linux/kernel.h>
-#include <linux/slab.h>
-#include "iwm.h"
-#include "umac.h"
-#include "commands.h"
-#include "eeprom.h"
-static struct iwm_eeprom_entry eeprom_map[] = {
-        [IWM_EEPROM_SIG] =
-        {"Signature", IWM_EEPROM_SIG_OFF, IWM_EEPROM_SIG_LEN},
-        [IWM_EEPROM_VERSION] =
-        {"Version", IWM_EEPROM_VERSION_OFF, IWM_EEPROM_VERSION_LEN},
-        [IWM_EEPROM_OEM_HW_VERSION] =
-        {"OEM HW version", IWM_EEPROM_OEM_HW_VERSION_OFF,
-         IWM_EEPROM_OEM_HW_VERSION_LEN},
-        [IWM_EEPROM_MAC_VERSION] =
-        {"MAC version", IWM_EEPROM_MAC_VERSION_OFF, IWM_EEPROM_MAC_VERSION_LEN},
-        [IWM_EEPROM_CARD_ID] =
-        {"Card ID", IWM_EEPROM_CARD_ID_OFF, IWM_EEPROM_CARD_ID_LEN},
-        [IWM_EEPROM_RADIO_CONF] =
-        {"Radio config", IWM_EEPROM_RADIO_CONF_OFF, IWM_EEPROM_RADIO_CONF_LEN},
-        [IWM_EEPROM_SKU_CAP] =
-        {"SKU capabilities", IWM_EEPROM_SKU_CAP_OFF, IWM_EEPROM_SKU_CAP_LEN},
-        [IWM_EEPROM_FAT_CHANNELS_CAP] =
-        {"HT channels capabilities", IWM_EEPROM_FAT_CHANNELS_CAP_OFF,
-         IWM_EEPROM_FAT_CHANNELS_CAP_LEN},
-        [IWM_EEPROM_CALIB_RXIQ_OFFSET] =
-        {"RX IQ offset", IWM_EEPROM_CALIB_RXIQ_OFF, IWM_EEPROM_INDIRECT_LEN},
-        [IWM_EEPROM_CALIB_RXIQ] =
-        {"Calib RX IQ", 0, IWM_EEPROM_CALIB_RXIQ_LEN},
-};
-static int iwm_eeprom_read(struct iwm_priv *iwm, u8 eeprom_id)
-{
-        int ret;
-        u32 entry_size, chunk_size, data_offset = 0, addr_offset = 0;
-        u32 addr;
-        struct iwm_udma_wifi_cmd udma_cmd;
-        struct iwm_umac_cmd umac_cmd;
-        struct iwm_umac_cmd_eeprom_proxy eeprom_cmd;
-        if (eeprom_id > (IWM_EEPROM_LAST - 1))
-                return -EINVAL;
-        entry_size = eeprom_map[eeprom_id].length;
-        if (eeprom_id >= IWM_EEPROM_INDIRECT_DATA) {
-                /* indirect data */
-                u32 off_id = eeprom_id - IWM_EEPROM_INDIRECT_DATA +
-                             IWM_EEPROM_INDIRECT_OFFSET;
-                eeprom_map[eeprom_id].offset =
-                        *(u16 *)(iwm->eeprom + eeprom_map[off_id].offset) << 1;
-        }
-        addr = eeprom_map[eeprom_id].offset;
-        udma_cmd.eop = 1;
-        udma_cmd.credit_group = 0x4;
-        udma_cmd.ra_tid = UMAC_HDI_ACT_TBL_IDX_HOST_CMD;
-        udma_cmd.lmac_offset = 0;
-        umac_cmd.id = UMAC_CMD_OPCODE_EEPROM_PROXY;
-        umac_cmd.resp = 1;
-        while (entry_size > 0) {
-                chunk_size = min_t(u32, entry_size, IWM_MAX_EEPROM_DATA_LEN);
-                eeprom_cmd.hdr.type =
-                        cpu_to_le32(IWM_UMAC_CMD_EEPROM_TYPE_READ);
-                eeprom_cmd.hdr.offset = cpu_to_le32(addr + addr_offset);
-                eeprom_cmd.hdr.len = cpu_to_le32(chunk_size);
-                ret = iwm_hal_send_umac_cmd(iwm, &udma_cmd,
-                                            &umac_cmd, &eeprom_cmd,
-                                     sizeof(struct iwm_umac_cmd_eeprom_proxy));
-                if (ret < 0) {
-                        IWM_ERR(iwm, "Couldn't read eeprom\n");
-                        return ret;
-                }
-                ret = iwm_notif_handle(iwm, UMAC_CMD_OPCODE_EEPROM_PROXY,
-                                       IWM_SRC_UMAC, 2*HZ);
-                if (ret < 0) {
-                        IWM_ERR(iwm, "Did not get any eeprom answer\n");
-                        return ret;
-                }
-                data_offset += chunk_size;
-                addr_offset += chunk_size;
-                entry_size -= chunk_size;
-        }
-        return 0;
-}
-u8 *iwm_eeprom_access(struct iwm_priv *iwm, u8 eeprom_id)
-{
-        if (!iwm->eeprom)
-                return ERR_PTR(-ENODEV);
-        return iwm->eeprom + eeprom_map[eeprom_id].offset;
-}
-int iwm_eeprom_fat_channels(struct iwm_priv *iwm)
-{
-        struct wiphy *wiphy = iwm_to_wiphy(iwm);
-        struct ieee80211_supported_band *band;
-        u16 *channels, i;
-        channels = (u16 *)iwm_eeprom_access(iwm, IWM_EEPROM_FAT_CHANNELS_CAP);
-        if (IS_ERR(channels))
-                return PTR_ERR(channels);
-        band = wiphy->bands[IEEE80211_BAND_2GHZ];
-        band->ht_cap.ht_supported = true;
-        for (i = 0; i < IWM_EEPROM_FAT_CHANNELS_24; i++)
-                if (!(channels[i] & IWM_EEPROM_FAT_CHANNEL_ENABLED))
-                        band->ht_cap.ht_supported = false;
-        band = wiphy->bands[IEEE80211_BAND_5GHZ];
-        band->ht_cap.ht_supported = true;
-        for (i = IWM_EEPROM_FAT_CHANNELS_24; i < IWM_EEPROM_FAT_CHANNELS; i++)
-                if (!(channels[i] & IWM_EEPROM_FAT_CHANNEL_ENABLED))
-                        band->ht_cap.ht_supported = false;
-        return 0;
-}
-u32 iwm_eeprom_wireless_mode(struct iwm_priv *iwm)
-{
-        u16 sku_cap;
-        u32 wireless_mode = 0;
-        sku_cap = *((u16 *)iwm_eeprom_access(iwm, IWM_EEPROM_SKU_CAP));
-        if (sku_cap & IWM_EEPROM_SKU_CAP_BAND_24GHZ)
-                wireless_mode |= WIRELESS_MODE_11G;
-        if (sku_cap & IWM_EEPROM_SKU_CAP_BAND_52GHZ)
-                wireless_mode |= WIRELESS_MODE_11A;
-        if (sku_cap & IWM_EEPROM_SKU_CAP_11N_ENABLE)
-                wireless_mode |= WIRELESS_MODE_11N;
-        return wireless_mode;
-}
-int iwm_eeprom_init(struct iwm_priv *iwm)
-{
-        int i, ret = 0;
-        char name[32];
-        iwm->eeprom = kzalloc(IWM_EEPROM_LEN, GFP_KERNEL);
-        if (!iwm->eeprom)
-                return -ENOMEM;
-        for (i = IWM_EEPROM_FIRST; i < IWM_EEPROM_LAST; i++) {
-                ret = iwm_eeprom_read(iwm, i);
-                if (ret < 0) {
-                        IWM_ERR(iwm, "Couldn't read eeprom entry #%d: %s\n",
-                                i, eeprom_map[i].name);
-                        break;
-                }
-        }
-        IWM_DBG_BOOT(iwm, DBG, "EEPROM dump:\n");
-        for (i = IWM_EEPROM_FIRST; i < IWM_EEPROM_LAST; i++) {
-                memset(name, 0, 32);
-                sprintf(name, "%s: ", eeprom_map[i].name);
-                IWM_HEXDUMP(iwm, DBG, BOOT, name,
-                            iwm->eeprom + eeprom_map[i].offset,
-                            eeprom_map[i].length);
-        }
-        return ret;
-}
-void iwm_eeprom_exit(struct iwm_priv *iwm)
-{
-        kfree(iwm->eeprom);
-}
diff --git a/drivers/net/wireless/iwmc3200wifi/eeprom.h b/drivers/net/wireless/iwmc3200wifi/eeprom.h
deleted file mode 100644
index 4e3a3fdab0d3..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/eeprom.h
+++ /dev/null
@@ -1,127 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- */
-#ifndef __IWM_EEPROM_H__
-#define __IWM_EEPROM_H__
-enum {
-        IWM_EEPROM_SIG = 0,
-        IWM_EEPROM_FIRST = IWM_EEPROM_SIG,
-        IWM_EEPROM_VERSION,
-        IWM_EEPROM_OEM_HW_VERSION,
-        IWM_EEPROM_MAC_VERSION,
-        IWM_EEPROM_CARD_ID,
-        IWM_EEPROM_RADIO_CONF,
-        IWM_EEPROM_SKU_CAP,
-        IWM_EEPROM_FAT_CHANNELS_CAP,
-        IWM_EEPROM_INDIRECT_OFFSET,
-        IWM_EEPROM_CALIB_RXIQ_OFFSET = IWM_EEPROM_INDIRECT_OFFSET,
-        IWM_EEPROM_INDIRECT_DATA,
-        IWM_EEPROM_CALIB_RXIQ = IWM_EEPROM_INDIRECT_DATA,
-        IWM_EEPROM_LAST,
-};
-#define IWM_EEPROM_SIG_OFF                 0x00
-#define IWM_EEPROM_VERSION_OFF            (0x54 << 1)
-#define IWM_EEPROM_OEM_HW_VERSION_OFF     (0x56 << 1)
-#define IWM_EEPROM_MAC_VERSION_OFF        (0x30 << 1)
-#define IWM_EEPROM_CARD_ID_OFF            (0x5d << 1)
-#define IWM_EEPROM_RADIO_CONF_OFF         (0x58 << 1)
-#define IWM_EEPROM_SKU_CAP_OFF            (0x55 << 1)
-#define IWM_EEPROM_CALIB_CONFIG_OFF       (0x7c << 1)
-#define IWM_EEPROM_FAT_CHANNELS_CAP_OFF   (0xde << 1)
-#define IWM_EEPROM_SIG_LEN              4
-#define IWM_EEPROM_VERSION_LEN          2
-#define IWM_EEPROM_OEM_HW_VERSION_LEN   2
-#define IWM_EEPROM_MAC_VERSION_LEN      1
-#define IWM_EEPROM_CARD_ID_LEN          2
-#define IWM_EEPROM_RADIO_CONF_LEN       2
-#define IWM_EEPROM_SKU_CAP_LEN          2
-#define IWM_EEPROM_FAT_CHANNELS_CAP_LEN 40
-#define IWM_EEPROM_INDIRECT_LEN         2
-#define IWM_MAX_EEPROM_DATA_LEN         240
-#define IWM_EEPROM_LEN                  0x800
-#define IWM_EEPROM_MIN_ALLOWED_VERSION          0x0610
-#define IWM_EEPROM_MAX_ALLOWED_VERSION          0x0700
-#define IWM_EEPROM_CURRENT_VERSION              0x0612
-#define IWM_EEPROM_SKU_CAP_BAND_24GHZ           (1 << 4)
-#define IWM_EEPROM_SKU_CAP_BAND_52GHZ           (1 << 5)
-#define IWM_EEPROM_SKU_CAP_11N_ENABLE           (1 << 6)
-#define IWM_EEPROM_FAT_CHANNELS 20
-/* 2.4 gHz FAT primary channels: 1, 2, 3, 4, 5, 6, 7, 8, 9 */
-#define IWM_EEPROM_FAT_CHANNELS_24 9
-/* 5.2 gHz FAT primary channels: 36,44,52,60,100,108,116,124,132,149,157 */
-#define IWM_EEPROM_FAT_CHANNELS_52 11
-#define IWM_EEPROM_FAT_CHANNEL_ENABLED (1 << 0)
-enum {
-        IWM_EEPROM_CALIB_CAL_HDR,
-        IWM_EEPROM_CALIB_TX_POWER,
-        IWM_EEPROM_CALIB_XTAL,
-        IWM_EEPROM_CALIB_TEMPERATURE,
-        IWM_EEPROM_CALIB_RX_BB_FILTER,
-        IWM_EEPROM_CALIB_RX_IQ,
-        IWM_EEPROM_CALIB_MAX,
-};
-#define IWM_EEPROM_CALIB_RXIQ_OFF       (IWM_EEPROM_CALIB_CONFIG_OFF + \
-                                         (IWM_EEPROM_CALIB_RX_IQ << 1))
-#define IWM_EEPROM_CALIB_RXIQ_LEN       sizeof(struct iwm_lmac_calib_rxiq)
-struct iwm_eeprom_entry {
-        char *name;
-        u32 offset;
-        u32 length;
-};
-int iwm_eeprom_init(struct iwm_priv *iwm);
-void iwm_eeprom_exit(struct iwm_priv *iwm);
-u8 *iwm_eeprom_access(struct iwm_priv *iwm, u8 eeprom_id);
-int iwm_eeprom_fat_channels(struct iwm_priv *iwm);
-u32 iwm_eeprom_wireless_mode(struct iwm_priv *iwm);
-#endif
diff --git a/drivers/net/wireless/iwmc3200wifi/fw.c b/drivers/net/wireless/iwmc3200wifi/fw.c
deleted file mode 100644
index 6f1afe6bbc8c..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/fw.c
+++ /dev/null
@@ -1,416 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- */
-#include <linux/kernel.h>
-#include <linux/firmware.h>
-#include "iwm.h"
-#include "bus.h"
-#include "hal.h"
-#include "umac.h"
-#include "debug.h"
-#include "fw.h"
-#include "commands.h"
-static const char fw_barker[] = "*WESTOPFORNOONE*";
-/*
- * @op_code: Op code we're looking for.
- * @index: There can be several instances of the same opcode within
- *         the firmware. Index specifies which one we're looking for.
- */
-static int iwm_fw_op_offset(struct iwm_priv *iwm, const struct firmware *fw,
-                            u16 op_code, u32 index)
-{
-        int offset = -EINVAL, fw_offset;
-        u32 op_index = 0;
-        const u8 *fw_ptr;
-        struct iwm_fw_hdr_rec *rec;
-        fw_offset = 0;
-        fw_ptr = fw->data;
-        /* We first need to look for the firmware barker */
-        if (memcmp(fw_ptr, fw_barker, IWM_HDR_BARKER_LEN)) {
-                IWM_ERR(iwm, "No barker string in this FW\n");
-                return -EINVAL;
-        }
-        if (fw->size < IWM_HDR_LEN) {
-                IWM_ERR(iwm, "FW is too small (%zu)\n", fw->size);
-                return -EINVAL;
-        }
-        fw_offset += IWM_HDR_BARKER_LEN;
-        while (fw_offset < fw->size) {
-                rec = (struct iwm_fw_hdr_rec *)(fw_ptr + fw_offset);
-                IWM_DBG_FW(iwm, DBG, "FW: op_code: 0x%x, len: %d @ 0x%x\n",
-                           rec->op_code, rec->len, fw_offset);
-                if (rec->op_code == IWM_HDR_REC_OP_INVALID) {
-                        IWM_DBG_FW(iwm, DBG, "Reached INVALID op code\n");
-                        break;
-                }
-                if (rec->op_code == op_code) {
-                        if (op_index == index) {
-                                fw_offset += sizeof(struct iwm_fw_hdr_rec);
-                                offset = fw_offset;
-                                goto out;
-                        }
-                        op_index++;
-                }
-                fw_offset += sizeof(struct iwm_fw_hdr_rec) + rec->len;
-        }
- out:
-        return offset;
-}
-static int iwm_load_firmware_chunk(struct iwm_priv *iwm,
-                                   const struct firmware *fw,
-                                   struct iwm_fw_img_desc *img_desc)
-{
-        struct iwm_udma_nonwifi_cmd target_cmd;
-        u32 chunk_size;
-        const u8 *chunk_ptr;
-        int ret = 0;
-        IWM_DBG_FW(iwm, INFO, "Loading FW chunk: %d bytes @ 0x%x\n",
-                   img_desc->length, img_desc->address);
-        target_cmd.opcode = UMAC_HDI_OUT_OPCODE_WRITE;
-        target_cmd.handle_by_hw = 1;
-        target_cmd.op2 = 0;
-        target_cmd.resp = 0;
-        target_cmd.eop = 1;
-        chunk_size = img_desc->length;
-        chunk_ptr = fw->data + img_desc->offset;
-        while (chunk_size > 0) {
-                u32 tmp_chunk_size;
-                tmp_chunk_size = min_t(u32, chunk_size,
-                                       IWM_MAX_NONWIFI_CMD_BUFF_SIZE);
-                target_cmd.addr = cpu_to_le32(img_desc->address +
-                                    (chunk_ptr - fw->data - img_desc->offset));
-                target_cmd.op1_sz = cpu_to_le32(tmp_chunk_size);
-                IWM_DBG_FW(iwm, DBG, "\t%d bytes @ 0x%x\n",
-                           tmp_chunk_size, target_cmd.addr);
-                ret = iwm_hal_send_target_cmd(iwm, &target_cmd, chunk_ptr);
-                if (ret < 0) {
-                        IWM_ERR(iwm, "Couldn't load FW chunk\n");
-                        break;
-                }
-                chunk_size -= tmp_chunk_size;
-                chunk_ptr += tmp_chunk_size;
-        }
-        return ret;
-}
-/*
- * To load a fw image to the target, we basically go through the
- * fw, looking for OP_MEM_DESC records. Once we found one, we
- * pass it to iwm_load_firmware_chunk().
- * The OP_MEM_DESC records contain the actuall memory chunk to be
- * sent, but also the destination address.
- */
-static int iwm_load_img(struct iwm_priv *iwm, const char *img_name)
-{
-        const struct firmware *fw;
-        struct iwm_fw_img_desc *img_desc;
-        struct iwm_fw_img_ver *ver;
-        int ret = 0, fw_offset;
-        u32 opcode_idx = 0, build_date;
-        char *build_tag;
-        ret = request_firmware(&fw, img_name, iwm_to_dev(iwm));
-        if (ret) {
-                IWM_ERR(iwm, "Request firmware failed");
-                return ret;
-        }
-        IWM_DBG_FW(iwm, INFO, "Start to load FW %s\n", img_name);
-        while (1) {
-                fw_offset = iwm_fw_op_offset(iwm, fw,
-                                             IWM_HDR_REC_OP_MEM_DESC,
-                                             opcode_idx);
-                if (fw_offset < 0)
-                        break;
-                img_desc = (struct iwm_fw_img_desc *)(fw->data + fw_offset);
-                ret = iwm_load_firmware_chunk(iwm, fw, img_desc);
-                if (ret < 0)
-                        goto err_release_fw;
-                opcode_idx++;
-        }
-        /* Read firmware version */
-        fw_offset = iwm_fw_op_offset(iwm, fw, IWM_HDR_REC_OP_SW_VER, 0);
-        if (fw_offset < 0)
-                goto err_release_fw;
-        ver = (struct iwm_fw_img_ver *)(fw->data + fw_offset);
-        /* Read build tag */
-        fw_offset = iwm_fw_op_offset(iwm, fw, IWM_HDR_REC_OP_BUILD_TAG, 0);
-        if (fw_offset < 0)
-                goto err_release_fw;
-        build_tag = (char *)(fw->data + fw_offset);
-        /* Read build date */
-        fw_offset = iwm_fw_op_offset(iwm, fw, IWM_HDR_REC_OP_BUILD_DATE, 0);
-        if (fw_offset < 0)
-                goto err_release_fw;
-        build_date = *(u32 *)(fw->data + fw_offset);
-        IWM_INFO(iwm, "%s:\n", img_name);
-        IWM_INFO(iwm, "\tVersion:    %02X.%02X\n", ver->major, ver->minor);
-        IWM_INFO(iwm, "\tBuild tag:  %s\n", build_tag);
-        IWM_INFO(iwm, "\tBuild date: %x-%x-%x\n",
-                 IWM_BUILD_YEAR(build_date), IWM_BUILD_MONTH(build_date),
-                 IWM_BUILD_DAY(build_date));
-        if (!strcmp(img_name, iwm->bus_ops->umac_name))
-                sprintf(iwm->umac_version, "%02X.%02X",
-                        ver->major, ver->minor);
-        if (!strcmp(img_name, iwm->bus_ops->lmac_name))
-                sprintf(iwm->lmac_version, "%02X.%02X",
-                        ver->major, ver->minor);
- err_release_fw:
-        release_firmware(fw);
-        return ret;
-}
-static int iwm_load_umac(struct iwm_priv *iwm)
-{
-        struct iwm_udma_nonwifi_cmd target_cmd;
-        int ret;
-        ret = iwm_load_img(iwm, iwm->bus_ops->umac_name);
-        if (ret < 0)
-                return ret;
-        /* We've loaded the UMAC, we can tell the target to jump there */
-        target_cmd.opcode = UMAC_HDI_OUT_OPCODE_JUMP;
-        target_cmd.addr = cpu_to_le32(UMAC_MU_FW_INST_DATA_12_ADDR);
-        target_cmd.op1_sz = 0;
-        target_cmd.op2 = 0;
-        target_cmd.handle_by_hw = 0;
-        target_cmd.resp = 1 ;
-        target_cmd.eop = 1;
-        ret = iwm_hal_send_target_cmd(iwm, &target_cmd, NULL);
-        if (ret < 0)
-                IWM_ERR(iwm, "Couldn't send JMP command\n");
-        return ret;
-}
-static int iwm_load_lmac(struct iwm_priv *iwm, const char *img_name)
-{
-        int ret;
-        ret = iwm_load_img(iwm, img_name);
-        if (ret < 0)
-                return ret;
-        return iwm_send_umac_reset(iwm,
-                        cpu_to_le32(UMAC_RST_CTRL_FLG_LARC_CLK_EN), 0);
-}
-static int iwm_init_calib(struct iwm_priv *iwm, unsigned long cfg_bitmap,
-                          unsigned long expected_bitmap, u8 rx_iq_cmd)
-{
-        /* Read RX IQ calibration result from EEPROM */
-        if (test_bit(rx_iq_cmd, &cfg_bitmap)) {
-                iwm_store_rxiq_calib_result(iwm);
-                set_bit(PHY_CALIBRATE_RX_IQ_CMD, &iwm->calib_done_map);
-        }
-        iwm_send_prio_table(iwm);
-        iwm_send_init_calib_cfg(iwm, cfg_bitmap);
-        while (iwm->calib_done_map != expected_bitmap) {
-                if (iwm_notif_handle(iwm, CALIBRATION_RES_NOTIFICATION,
-                                     IWM_SRC_LMAC, WAIT_NOTIF_TIMEOUT)) {
-                        IWM_DBG_FW(iwm, DBG, "Initial calibration timeout\n");
-                        return -ETIMEDOUT;
-                }
-                IWM_DBG_FW(iwm, DBG, "Got calibration result. calib_done_map: "
-                           "0x%lx, expected calibrations: 0x%lx\n",
-                           iwm->calib_done_map, expected_bitmap);
-        }
-        return 0;
-}
-/*
- * We currently have to load 3 FWs:
- * 1) The UMAC (Upper MAC).
- * 2) The calibration LMAC (Lower MAC).
- *    We then send the calibration init command, so that the device can
- *    run a first calibration round.
- * 3) The operational LMAC, which replaces the calibration one when it's
- *    done with the first calibration round.
- *
- * Once those 3 FWs have been loaded, we send the periodic calibration
- * command, and then the device is available for regular 802.11 operations.
- */
-int iwm_load_fw(struct iwm_priv *iwm)
-{
-        unsigned long init_calib_map, periodic_calib_map;
-        unsigned long expected_calib_map;
-        int ret;
-        /* We first start downloading the UMAC */
-        ret = iwm_load_umac(iwm);
-        if (ret < 0) {
-                IWM_ERR(iwm, "UMAC loading failed\n");
-                return ret;
-        }
-        /* Handle UMAC_ALIVE notification */
-        ret = iwm_notif_handle(iwm, UMAC_NOTIFY_OPCODE_ALIVE, IWM_SRC_UMAC,
-                               WAIT_NOTIF_TIMEOUT);
-        if (ret) {
-                IWM_ERR(iwm, "Handle UMAC_ALIVE failed: %d\n", ret);
-                return ret;
-        }
-        /* UMAC is alive, we can download the calibration LMAC */
-        ret = iwm_load_lmac(iwm, iwm->bus_ops->calib_lmac_name);
-        if (ret) {
-                IWM_ERR(iwm, "Calibration LMAC loading failed\n");
-                return ret;
-        }
-        /* Handle UMAC_INIT_COMPLETE notification */
-        ret = iwm_notif_handle(iwm, UMAC_NOTIFY_OPCODE_INIT_COMPLETE,
-                               IWM_SRC_UMAC, WAIT_NOTIF_TIMEOUT);
-        if (ret) {
-                IWM_ERR(iwm, "Handle INIT_COMPLETE failed for calibration "
-                        "LMAC: %d\n", ret);
-                return ret;
-        }
-        /* Read EEPROM data */
-        ret = iwm_eeprom_init(iwm);
-        if (ret < 0) {
-                IWM_ERR(iwm, "Couldn't init eeprom array\n");
-                return ret;
-        }
-        init_calib_map = iwm->conf.calib_map & IWM_CALIB_MAP_INIT_MSK;
-        expected_calib_map = iwm->conf.expected_calib_map &
-                IWM_CALIB_MAP_INIT_MSK;
-        periodic_calib_map = IWM_CALIB_MAP_PER_LMAC(iwm->conf.calib_map);
-        ret = iwm_init_calib(iwm, init_calib_map, expected_calib_map,
-                             CALIB_CFG_RX_IQ_IDX);
-        if (ret < 0) {
-                /* Let's try the old way */
-                ret = iwm_init_calib(iwm, expected_calib_map,
-                                     expected_calib_map,
-                                     PHY_CALIBRATE_RX_IQ_CMD);
-                if (ret < 0) {
-                        IWM_ERR(iwm, "Calibration result timeout\n");
-                        goto out;
-                }
-        }
-        /* Handle LMAC CALIBRATION_COMPLETE notification */
-        ret = iwm_notif_handle(iwm, CALIBRATION_COMPLETE_NOTIFICATION,
-                               IWM_SRC_LMAC, WAIT_NOTIF_TIMEOUT);
-        if (ret) {
-                IWM_ERR(iwm, "Wait for CALIBRATION_COMPLETE timeout\n");
-                goto out;
-        }
-        IWM_INFO(iwm, "LMAC calibration done: 0x%lx\n", iwm->calib_done_map);
-        iwm_send_umac_reset(iwm, cpu_to_le32(UMAC_RST_CTRL_FLG_LARC_RESET), 1);
-        ret = iwm_notif_handle(iwm, UMAC_CMD_OPCODE_RESET, IWM_SRC_UMAC,
-                               WAIT_NOTIF_TIMEOUT);
-        if (ret) {
-                IWM_ERR(iwm, "Wait for UMAC RESET timeout\n");
-                goto out;
-        }
-        /* Download the operational LMAC */
-        ret = iwm_load_lmac(iwm, iwm->bus_ops->lmac_name);
-        if (ret) {
-                IWM_ERR(iwm, "LMAC loading failed\n");
-                goto out;
-        }
-        ret = iwm_notif_handle(iwm, UMAC_NOTIFY_OPCODE_INIT_COMPLETE,
-                               IWM_SRC_UMAC, WAIT_NOTIF_TIMEOUT);
-        if (ret) {
-                IWM_ERR(iwm, "Handle INIT_COMPLETE failed for LMAC: %d\n", ret);
-                goto out;
-        }
-        iwm_send_prio_table(iwm);
-        iwm_send_calib_results(iwm);
-        iwm_send_periodic_calib_cfg(iwm, periodic_calib_map);
-        iwm_send_ct_kill_cfg(iwm, iwm->conf.ct_kill_entry,
-                             iwm->conf.ct_kill_exit);
-        return 0;
- out:
-        iwm_eeprom_exit(iwm);
-        return ret;
-}
diff --git a/drivers/net/wireless/iwmc3200wifi/fw.h b/drivers/net/wireless/iwmc3200wifi/fw.h
deleted file mode 100644
index c70a3b40dad3..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/fw.h
+++ /dev/null
@@ -1,100 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- */
-#ifndef __IWM_FW_H__
-#define __IWM_FW_H__
-/**
- * struct iwm_fw_hdr_rec - An iwm firmware image is a
- * concatenation of various records. Each of them is
- * defined by an ID (aka op code), a length, and the
- * actual data.
- * @op_code: The record ID, see IWM_HDR_REC_OP_*
- *
- * @len: The record payload length
- *
- * @buf: The record payload
- */
-struct iwm_fw_hdr_rec {
-        u16 op_code;
-        u16 len;
-        u8 buf[0];
-};
-/* Header's definitions */
-#define IWM_HDR_LEN                          (512)
-#define IWM_HDR_BARKER_LEN                   (16)
-/* Header's opcodes */
-#define IWM_HDR_REC_OP_INVALID             (0x00)
-#define IWM_HDR_REC_OP_BUILD_DATE          (0x01)
-#define IWM_HDR_REC_OP_BUILD_TAG           (0x02)
-#define IWM_HDR_REC_OP_SW_VER              (0x03)
-#define IWM_HDR_REC_OP_HW_SKU              (0x04)
-#define IWM_HDR_REC_OP_BUILD_OPT           (0x05)
-#define IWM_HDR_REC_OP_MEM_DESC            (0x06)
-#define IWM_HDR_REC_USERDEFS               (0x07)
-/* Header's records length (in bytes) */
-#define IWM_HDR_REC_LEN_BUILD_DATE           (4)
-#define IWM_HDR_REC_LEN_BUILD_TAG            (64)
-#define IWM_HDR_REC_LEN_SW_VER               (4)
-#define IWM_HDR_REC_LEN_HW_SKU               (4)
-#define IWM_HDR_REC_LEN_BUILD_OPT            (4)
-#define IWM_HDR_REC_LEN_MEM_DESC             (12)
-#define IWM_HDR_REC_LEN_USERDEF              (64)
-#define IWM_BUILD_YEAR(date) ((date >> 16) & 0xffff)
-#define IWM_BUILD_MONTH(date) ((date >> 8) & 0xff)
-#define IWM_BUILD_DAY(date) (date & 0xff)
-struct iwm_fw_img_desc {
-        u32 offset;
-        u32 address;
-        u32 length;
-};
-struct iwm_fw_img_ver {
-        u8 minor;
-        u8 major;
-        u16 reserved;
-};
-int iwm_load_fw(struct iwm_priv *iwm);
-#endif
diff --git a/drivers/net/wireless/iwmc3200wifi/hal.c b/drivers/net/wireless/iwmc3200wifi/hal.c
deleted file mode 100644
index 1cabcb39643f..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/hal.c
+++ /dev/null
@@ -1,470 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- */
-/*
- * Hardware Abstraction Layer for iwm.
- *
- * This file mostly defines an abstraction API for
- * sending various commands to the target.
- *
- * We have 2 types of commands: wifi and non-wifi ones.
- *
- * - wifi commands:
- *   They are used for sending LMAC and UMAC commands,
- *   and thus are the most commonly used ones.
- *   There are 2 different wifi command types, the regular
- *   one and the LMAC one. The former is used to send
- *   UMAC commands (see UMAC_CMD_OPCODE_* from umac.h)
- *   while the latter is used for sending commands to the
- *   LMAC. If you look at LMAC commands you'll se that they
- *   are actually regular iwlwifi target commands encapsulated
- *   into a special UMAC command called UMAC passthrough.
- *   This is due to the fact the host talks exclusively
- *   to the UMAC and so there needs to be a special UMAC
- *   command for talking to the LMAC.
- *   This is how a wifi command is laid out:
- *    ------------------------
- *   | iwm_udma_out_wifi_hdr  |
- *    ------------------------
- *   | SW meta_data (32 bits) |
- *    ------------------------
- *   | iwm_dev_cmd_hdr        |
- *    ------------------------
- *   | payload                |
- *   | ....                   |
- *
- * - non-wifi, or general commands:
- *   Those commands are handled by the device's bootrom,
- *   and are typically sent when the UMAC and the LMAC
- *   are not yet available.
- *    *   This is how a non-wifi command is laid out:
- *    ---------------------------
- *   | iwm_udma_out_nonwifi_hdr  |
- *    ---------------------------
- *   | payload                   |
- *   | ....                      |
- *
- * All the commands start with a UDMA header, which is
- * basically a 32 bits field. The 4 LSB there define
- * an opcode that allows the target to differentiate
- * between wifi (opcode is 0xf) and non-wifi commands
- * (opcode is [0..0xe]).
- *
- * When a command (wifi or non-wifi) is supposed to receive
- * an answer, we queue the command buffer. When we do receive
- * a command response from the UMAC, we go through the list
- * of pending command, and pass both the command and the answer
- * to the rx handler. Each command is sent with a unique
- * sequence id, and the answer is sent with the same one. This
- * is how we're supposed to match an answer with its command.
- * See rx.c:iwm_rx_handle_[non]wifi() and iwm_get_pending_[non]wifi()
- * for the implementation details.
- */
-#include <linux/kernel.h>
-#include <linux/netdevice.h>
-#include <linux/slab.h>
-#include "iwm.h"
-#include "bus.h"
-#include "hal.h"
-#include "umac.h"
-#include "debug.h"
-#include "trace.h"
-static int iwm_nonwifi_cmd_init(struct iwm_priv *iwm,
-                                struct iwm_nonwifi_cmd *cmd,
-                                struct iwm_udma_nonwifi_cmd *udma_cmd)
-{
-        INIT_LIST_HEAD(&cmd->pending);
-        spin_lock(&iwm->cmd_lock);
-        cmd->resp_received = 0;
-        cmd->seq_num = iwm->nonwifi_seq_num;
-        udma_cmd->seq_num = cpu_to_le16(cmd->seq_num);
-        iwm->nonwifi_seq_num++;
-        iwm->nonwifi_seq_num %= UMAC_NONWIFI_SEQ_NUM_MAX;
-        if (udma_cmd->resp)
-                list_add_tail(&cmd->pending, &iwm->nonwifi_pending_cmd);
-        spin_unlock(&iwm->cmd_lock);
-        cmd->buf.start = cmd->buf.payload;
-        cmd->buf.len = 0;
-        memcpy(&cmd->udma_cmd, udma_cmd, sizeof(*udma_cmd));
-        return cmd->seq_num;
-}
-u16 iwm_alloc_wifi_cmd_seq(struct iwm_priv *iwm)
-{
-        u16 seq_num = iwm->wifi_seq_num;
-        iwm->wifi_seq_num++;
-        iwm->wifi_seq_num %= UMAC_WIFI_SEQ_NUM_MAX;
-        return seq_num;
-}
-static void iwm_wifi_cmd_init(struct iwm_priv *iwm,
-                              struct iwm_wifi_cmd *cmd,
-                              struct iwm_udma_wifi_cmd *udma_cmd,
-                              struct iwm_umac_cmd *umac_cmd,
-                              struct iwm_lmac_cmd *lmac_cmd,
-                              u16 payload_size)
-{
-        INIT_LIST_HEAD(&cmd->pending);
-        spin_lock(&iwm->cmd_lock);
-        cmd->seq_num = iwm_alloc_wifi_cmd_seq(iwm);
-        umac_cmd->seq_num = cpu_to_le16(cmd->seq_num);
-        if (umac_cmd->resp)
-                list_add_tail(&cmd->pending, &iwm->wifi_pending_cmd);
-        spin_unlock(&iwm->cmd_lock);
-        cmd->buf.start = cmd->buf.payload;
-        cmd->buf.len = 0;
-        if (lmac_cmd) {
-                cmd->buf.start -= sizeof(struct iwm_lmac_hdr);
-                lmac_cmd->seq_num = cpu_to_le16(cmd->seq_num);
-                lmac_cmd->count = cpu_to_le16(payload_size);
-                memcpy(&cmd->lmac_cmd, lmac_cmd, sizeof(*lmac_cmd));
-                umac_cmd->count = cpu_to_le16(sizeof(struct iwm_lmac_hdr));
-        } else
-                umac_cmd->count = 0;
-        umac_cmd->count = cpu_to_le16(payload_size +
-                                      le16_to_cpu(umac_cmd->count));
-        udma_cmd->count = cpu_to_le16(sizeof(struct iwm_umac_fw_cmd_hdr) +
-                                      le16_to_cpu(umac_cmd->count));
-        memcpy(&cmd->udma_cmd, udma_cmd, sizeof(*udma_cmd));
-        memcpy(&cmd->umac_cmd, umac_cmd, sizeof(*umac_cmd));
-}
-void iwm_cmd_flush(struct iwm_priv *iwm)
-{
-        struct iwm_wifi_cmd *wcmd, *wnext;
-        struct iwm_nonwifi_cmd *nwcmd, *nwnext;
-        list_for_each_entry_safe(wcmd, wnext, &iwm->wifi_pending_cmd, pending) {
-                list_del(&wcmd->pending);
-                kfree(wcmd);
-        }
-        list_for_each_entry_safe(nwcmd, nwnext, &iwm->nonwifi_pending_cmd,
-                                 pending) {
-                list_del(&nwcmd->pending);
-                kfree(nwcmd);
-        }
-}
-struct iwm_wifi_cmd *iwm_get_pending_wifi_cmd(struct iwm_priv *iwm, u16 seq_num)
-{
-        struct iwm_wifi_cmd *cmd;
-        list_for_each_entry(cmd, &iwm->wifi_pending_cmd, pending)
-                if (cmd->seq_num == seq_num) {
-                        list_del(&cmd->pending);
-                        return cmd;
-                }
-        return NULL;
-}
-struct iwm_nonwifi_cmd *iwm_get_pending_nonwifi_cmd(struct iwm_priv *iwm,
-                                                    u8 seq_num, u8 cmd_opcode)
-{
-        struct iwm_nonwifi_cmd *cmd;
-        list_for_each_entry(cmd, &iwm->nonwifi_pending_cmd, pending)
-                if ((cmd->seq_num == seq_num) &&
-                    (cmd->udma_cmd.opcode == cmd_opcode) &&
-                    (cmd->resp_received)) {
-                        list_del(&cmd->pending);
-                        return cmd;
-                }
-        return NULL;
-}
-static void iwm_build_udma_nonwifi_hdr(struct iwm_priv *iwm,
-                                       struct iwm_udma_out_nonwifi_hdr *hdr,
-                                       struct iwm_udma_nonwifi_cmd *cmd)
-{
-        memset(hdr, 0, sizeof(*hdr));
-        SET_VAL32(hdr->cmd, UMAC_HDI_OUT_CMD_OPCODE, cmd->opcode);
-        SET_VAL32(hdr->cmd, UDMA_HDI_OUT_NW_CMD_RESP, cmd->resp);
-        SET_VAL32(hdr->cmd, UMAC_HDI_OUT_CMD_EOT, 1);
-        SET_VAL32(hdr->cmd, UDMA_HDI_OUT_NW_CMD_HANDLE_BY_HW,
-                  cmd->handle_by_hw);
-        SET_VAL32(hdr->cmd, UMAC_HDI_OUT_CMD_SIGNATURE, UMAC_HDI_OUT_SIGNATURE);
-        SET_VAL32(hdr->cmd, UDMA_HDI_OUT_CMD_NON_WIFI_HW_SEQ_NUM,
-                  le16_to_cpu(cmd->seq_num));
-        hdr->addr = cmd->addr;
-        hdr->op1_sz = cmd->op1_sz;
-        hdr->op2 = cmd->op2;
-}
-static int iwm_send_udma_nonwifi_cmd(struct iwm_priv *iwm,
-                                     struct iwm_nonwifi_cmd *cmd)
-{
-        struct iwm_udma_out_nonwifi_hdr *udma_hdr;
-        struct iwm_nonwifi_cmd_buff *buf;
-        struct iwm_udma_nonwifi_cmd *udma_cmd = &cmd->udma_cmd;
-        buf = &cmd->buf;
-        buf->start -= sizeof(struct iwm_umac_nonwifi_out_hdr);
-        buf->len += sizeof(struct iwm_umac_nonwifi_out_hdr);
-        udma_hdr = (struct iwm_udma_out_nonwifi_hdr *)(buf->start);
-        iwm_build_udma_nonwifi_hdr(iwm, udma_hdr, udma_cmd);
-        IWM_DBG_CMD(iwm, DBG,
-                    "Send UDMA nonwifi cmd: opcode = 0x%x, resp = 0x%x, "
-                    "hw = 0x%x, seqnum = %d, addr = 0x%x, op1_sz = 0x%x, "
-                    "op2 = 0x%x\n", udma_cmd->opcode, udma_cmd->resp,
-                    udma_cmd->handle_by_hw, cmd->seq_num, udma_cmd->addr,
-                    udma_cmd->op1_sz, udma_cmd->op2);
-        trace_iwm_tx_nonwifi_cmd(iwm, udma_hdr);
-        return iwm_bus_send_chunk(iwm, buf->start, buf->len);
-}
-void iwm_udma_wifi_hdr_set_eop(struct iwm_priv *iwm, u8 *buf, u8 eop)
-{
-        struct iwm_udma_out_wifi_hdr *hdr = (struct iwm_udma_out_wifi_hdr *)buf;
-        SET_VAL32(hdr->cmd, UMAC_HDI_OUT_CMD_EOT, eop);
-}
-void iwm_build_udma_wifi_hdr(struct iwm_priv *iwm,
-                             struct iwm_udma_out_wifi_hdr *hdr,
-                             struct iwm_udma_wifi_cmd *cmd)
-{
-        memset(hdr, 0, sizeof(*hdr));
-        SET_VAL32(hdr->cmd, UMAC_HDI_OUT_CMD_OPCODE, UMAC_HDI_OUT_OPCODE_WIFI);
-        SET_VAL32(hdr->cmd, UMAC_HDI_OUT_CMD_EOT, cmd->eop);
-        SET_VAL32(hdr->cmd, UMAC_HDI_OUT_CMD_SIGNATURE, UMAC_HDI_OUT_SIGNATURE);
-        SET_VAL32(hdr->meta_data, UMAC_HDI_OUT_BYTE_COUNT,
-                  le16_to_cpu(cmd->count));
-        SET_VAL32(hdr->meta_data, UMAC_HDI_OUT_CREDIT_GRP, cmd->credit_group);
-        SET_VAL32(hdr->meta_data, UMAC_HDI_OUT_RATID, cmd->ra_tid);
-        SET_VAL32(hdr->meta_data, UMAC_HDI_OUT_LMAC_OFFSET, cmd->lmac_offset);
-}
-void iwm_build_umac_hdr(struct iwm_priv *iwm,
-                        struct iwm_umac_fw_cmd_hdr *hdr,
-                        struct iwm_umac_cmd *cmd)
-{
-        memset(hdr, 0, sizeof(*hdr));
-        SET_VAL32(hdr->meta_data, UMAC_FW_CMD_BYTE_COUNT,
-                  le16_to_cpu(cmd->count));
-        SET_VAL32(hdr->meta_data, UMAC_FW_CMD_TX_STA_COLOR, cmd->color);
-        SET_VAL8(hdr->cmd.flags, UMAC_DEV_CMD_FLAGS_RESP_REQ, cmd->resp);
-        hdr->cmd.cmd = cmd->id;
-        hdr->cmd.seq_num = cmd->seq_num;
-}
-static int iwm_send_udma_wifi_cmd(struct iwm_priv *iwm,
-                                  struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_umac_wifi_out_hdr *umac_hdr;
-        struct iwm_wifi_cmd_buff *buf;
-        struct iwm_udma_wifi_cmd *udma_cmd = &cmd->udma_cmd;
-        struct iwm_umac_cmd *umac_cmd = &cmd->umac_cmd;
-        int ret;
-        buf = &cmd->buf;
-        buf->start -= sizeof(struct iwm_umac_wifi_out_hdr);
-        buf->len += sizeof(struct iwm_umac_wifi_out_hdr);
-        umac_hdr = (struct iwm_umac_wifi_out_hdr *)(buf->start);
-        iwm_build_udma_wifi_hdr(iwm, &umac_hdr->hw_hdr, udma_cmd);
-        iwm_build_umac_hdr(iwm, &umac_hdr->sw_hdr, umac_cmd);
-        IWM_DBG_CMD(iwm, DBG,
-                    "Send UDMA wifi cmd: opcode = 0x%x, UMAC opcode = 0x%x, "
-                    "eop = 0x%x, count = 0x%x, credit_group = 0x%x, "
-                    "ra_tid = 0x%x, lmac_offset = 0x%x, seqnum = %d\n",
-                    UMAC_HDI_OUT_OPCODE_WIFI, umac_cmd->id,
-                    udma_cmd->eop, udma_cmd->count, udma_cmd->credit_group,
-                    udma_cmd->ra_tid, udma_cmd->lmac_offset, cmd->seq_num);
-        if (umac_cmd->id == UMAC_CMD_OPCODE_WIFI_PASS_THROUGH)
-                IWM_DBG_CMD(iwm, DBG, "\tLMAC opcode: 0x%x\n",
-                            cmd->lmac_cmd.id);
-        ret = iwm_tx_credit_alloc(iwm, udma_cmd->credit_group, buf->len);
-        /* We keep sending UMAC reset regardless of the command credits.
-         * The UMAC is supposed to be reset anyway and the Tx credits are
-         * reinitialized afterwards. If we are lucky, the reset could
-         * still be done even though we have run out of credits for the
-         * command pool at this moment.*/
-        if (ret && (umac_cmd->id != UMAC_CMD_OPCODE_RESET)) {
-                IWM_DBG_TX(iwm, DBG, "Failed to alloc tx credit for cmd %d\n",
-                           umac_cmd->id);
-                return ret;
-        }
-        trace_iwm_tx_wifi_cmd(iwm, umac_hdr);
-        return iwm_bus_send_chunk(iwm, buf->start, buf->len);
-}
-/* target_cmd a.k.a udma_nonwifi_cmd can be sent when UMAC is not available */
-int iwm_hal_send_target_cmd(struct iwm_priv *iwm,
-                            struct iwm_udma_nonwifi_cmd *udma_cmd,
-                            const void *payload)
-{
-        struct iwm_nonwifi_cmd *cmd;
-        int ret, seq_num;
-        cmd = kzalloc(sizeof(struct iwm_nonwifi_cmd), GFP_KERNEL);
-        if (!cmd) {
-                IWM_ERR(iwm, "Couldn't alloc memory for hal cmd\n");
-                return -ENOMEM;
-        }
-        seq_num = iwm_nonwifi_cmd_init(iwm, cmd, udma_cmd);
-        if (cmd->udma_cmd.opcode == UMAC_HDI_OUT_OPCODE_WRITE ||
-            cmd->udma_cmd.opcode == UMAC_HDI_OUT_OPCODE_WRITE_PERSISTENT) {
-                cmd->buf.len = le32_to_cpu(cmd->udma_cmd.op1_sz);
-                memcpy(&cmd->buf.payload, payload, cmd->buf.len);
-        }
-        ret = iwm_send_udma_nonwifi_cmd(iwm, cmd);
-        if (!udma_cmd->resp)
-                kfree(cmd);
-        if (ret < 0)
-                return ret;
-        return seq_num;
-}
-static void iwm_build_lmac_hdr(struct iwm_priv *iwm, struct iwm_lmac_hdr *hdr,
-                               struct iwm_lmac_cmd *cmd)
-{
-        memset(hdr, 0, sizeof(*hdr));
-        hdr->id = cmd->id;
-        hdr->flags = 0; /* Is this ever used? */
-        hdr->seq_num = cmd->seq_num;
-}
-/*
- * iwm_hal_send_host_cmd(): sends commands to the UMAC or the LMAC.
- * Sending command to the LMAC is equivalent to sending a
- * regular UMAC command with the LMAC passthrough or the LMAC
- * wrapper UMAC command IDs.
- */
-int iwm_hal_send_host_cmd(struct iwm_priv *iwm,
-                          struct iwm_udma_wifi_cmd *udma_cmd,
-                          struct iwm_umac_cmd *umac_cmd,
-                          struct iwm_lmac_cmd *lmac_cmd,
-                          const void *payload, u16 payload_size)
-{
-        struct iwm_wifi_cmd *cmd;
-        struct iwm_lmac_hdr *hdr;
-        int lmac_hdr_len = 0;
-        int ret;
-        cmd = kzalloc(sizeof(struct iwm_wifi_cmd), GFP_KERNEL);
-        if (!cmd) {
-                IWM_ERR(iwm, "Couldn't alloc memory for wifi hal cmd\n");
-                return -ENOMEM;
-        }
-        iwm_wifi_cmd_init(iwm, cmd, udma_cmd, umac_cmd, lmac_cmd, payload_size);
-        if (lmac_cmd) {
-                hdr = (struct iwm_lmac_hdr *)(cmd->buf.start);
-                iwm_build_lmac_hdr(iwm, hdr, &cmd->lmac_cmd);
-                lmac_hdr_len = sizeof(struct iwm_lmac_hdr);
-        }
-        memcpy(cmd->buf.payload, payload, payload_size);
-        cmd->buf.len = le16_to_cpu(umac_cmd->count);
-        ret = iwm_send_udma_wifi_cmd(iwm, cmd);
-        /* We free the cmd if we're not expecting any response */
-        if (!umac_cmd->resp)
-                kfree(cmd);
-        return ret;
-}
-/*
- * iwm_hal_send_umac_cmd(): This is a special case for
- * iwm_hal_send_host_cmd() to send direct UMAC cmd (without
- * LMAC involved).
- */
-int iwm_hal_send_umac_cmd(struct iwm_priv *iwm,
-                          struct iwm_udma_wifi_cmd *udma_cmd,
-                          struct iwm_umac_cmd *umac_cmd,
-                          const void *payload, u16 payload_size)
-{
-        return iwm_hal_send_host_cmd(iwm, udma_cmd, umac_cmd, NULL,
-                                     payload, payload_size);
-}
diff --git a/drivers/net/wireless/iwmc3200wifi/hal.h b/drivers/net/wireless/iwmc3200wifi/hal.h
deleted file mode 100644
index c20936d9b6b7..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/hal.h
+++ /dev/null
@@ -1,237 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- */
-#ifndef _IWM_HAL_H_
-#define _IWM_HAL_H_
-#include "umac.h"
-#define GET_VAL8(s, name)       ((s >> name##_POS) & name##_SEED)
-#define GET_VAL16(s, name)      ((le16_to_cpu(s) >> name##_POS) & name##_SEED)
-#define GET_VAL32(s, name)      ((le32_to_cpu(s) >> name##_POS) & name##_SEED)
-#define SET_VAL8(s, name, val)                                            \
-do {                                                                      \
-        s = (s & ~(name##_SEED << name##_POS)) |                          \
-            ((val & name##_SEED) << name##_POS);                          \
-} while (0)
-#define SET_VAL16(s, name, val)                                           \
-do {                                                                      \
-        s = cpu_to_le16((le16_to_cpu(s) & ~(name##_SEED << name##_POS)) | \
-                        ((val & name##_SEED) << name##_POS));             \
-} while (0)
-#define SET_VAL32(s, name, val)                                           \
-do {                                                                      \
-        s = cpu_to_le32((le32_to_cpu(s) & ~(name##_SEED << name##_POS)) | \
-                        ((val & name##_SEED) << name##_POS));             \
-} while (0)
-#define UDMA_UMAC_INIT  {       .eop = 1,                                 \
-                                .credit_group = 0x4,                      \
-                                .ra_tid = UMAC_HDI_ACT_TBL_IDX_HOST_CMD,  \
-                                .lmac_offset = 0 }
-#define UDMA_LMAC_INIT  {       .eop = 1,                                 \
-                                .credit_group = 0x4,                      \
-                                .ra_tid = UMAC_HDI_ACT_TBL_IDX_HOST_CMD,  \
-                                .lmac_offset = 4 }
-/* UDMA IN OP CODE -- cmd bits [3:0] */
-#define UDMA_HDI_IN_NW_CMD_OPCODE_POS           0
-#define UDMA_HDI_IN_NW_CMD_OPCODE_SEED          0xF
-#define UDMA_IN_OPCODE_GENERAL_RESP             0x0
-#define UDMA_IN_OPCODE_READ_RESP                0x1
-#define UDMA_IN_OPCODE_WRITE_RESP               0x2
-#define UDMA_IN_OPCODE_PERS_WRITE_RESP          0x5
-#define UDMA_IN_OPCODE_PERS_READ_RESP           0x6
-#define UDMA_IN_OPCODE_RD_MDFY_WR_RESP          0x7
-#define UDMA_IN_OPCODE_EP_MNGMT_MSG             0x8
-#define UDMA_IN_OPCODE_CRDT_CHNG_MSG            0x9
-#define UDMA_IN_OPCODE_CNTRL_DATABASE_MSG       0xA
-#define UDMA_IN_OPCODE_SW_MSG                   0xB
-#define UDMA_IN_OPCODE_WIFI                     0xF
-#define UDMA_IN_OPCODE_WIFI_LMAC                0x1F
-#define UDMA_IN_OPCODE_WIFI_UMAC                0x2F
-/* HW API: udma_hdi_nonwifi API (OUT and IN) */
-/* iwm_udma_nonwifi_cmd request response -- bits [9:9] */
-#define UDMA_HDI_OUT_NW_CMD_RESP_POS            9
-#define UDMA_HDI_OUT_NW_CMD_RESP_SEED           0x1
-/* iwm_udma_nonwifi_cmd handle by HW -- bits [11:11] */
-#define UDMA_HDI_OUT_NW_CMD_HANDLE_BY_HW_POS    11
-#define UDMA_HDI_OUT_NW_CMD_HANDLE_BY_HW_SEED   0x1
-/* iwm_udma_nonwifi_cmd sequence-number -- bits [12:15] */
-#define UDMA_HDI_OUT_NW_CMD_SEQ_NUM_POS         12
-#define UDMA_HDI_OUT_NW_CMD_SEQ_NUM_SEED        0xF
-/* UDMA IN Non-WIFI HW sequence number -- bits [12:15] */
-#define UDMA_IN_NW_HW_SEQ_NUM_POS               12
-#define UDMA_IN_NW_HW_SEQ_NUM_SEED              0xF
-/* UDMA IN Non-WIFI HW signature -- bits [16:31] */
-#define UDMA_IN_NW_HW_SIG_POS                   16
-#define UDMA_IN_NW_HW_SIG_SEED                  0xFFFF
-/* fixed signature */
-#define UDMA_IN_NW_HW_SIG                       0xCBBC
-/* UDMA IN Non-WIFI HW block length -- bits [32:35] */
-#define UDMA_IN_NW_HW_LENGTH_SEED               0xF
-#define UDMA_IN_NW_HW_LENGTH_POS                32
-/* End of HW API: udma_hdi_nonwifi API (OUT and IN) */
-#define IWM_SDIO_FW_MAX_CHUNK_SIZE      2032
-#define IWM_MAX_WIFI_HEADERS_SIZE       32
-#define IWM_MAX_NONWIFI_HEADERS_SIZE    16
-#define IWM_MAX_NONWIFI_CMD_BUFF_SIZE   (IWM_SDIO_FW_MAX_CHUNK_SIZE - \
-                                         IWM_MAX_NONWIFI_HEADERS_SIZE)
-#define IWM_MAX_WIFI_CMD_BUFF_SIZE      (IWM_SDIO_FW_MAX_CHUNK_SIZE - \
-                                         IWM_MAX_WIFI_HEADERS_SIZE)
-#define IWM_HAL_CONCATENATE_BUF_SIZE    (32 * 1024)
-struct iwm_wifi_cmd_buff {
-        u16 len;
-        u8 *start;
-        u8 hdr[IWM_MAX_WIFI_HEADERS_SIZE];
-        u8 payload[IWM_MAX_WIFI_CMD_BUFF_SIZE];
-};
-struct iwm_nonwifi_cmd_buff {
-        u16 len;
-        u8 *start;
-        u8 hdr[IWM_MAX_NONWIFI_HEADERS_SIZE];
-        u8 payload[IWM_MAX_NONWIFI_CMD_BUFF_SIZE];
-};
-struct iwm_udma_nonwifi_cmd {
-        u8 opcode;
-        u8 eop;
-        u8 resp;
-        u8 handle_by_hw;
-        __le32 addr;
-        __le32 op1_sz;
-        __le32 op2;
-        __le16 seq_num;
-};
-struct iwm_udma_wifi_cmd {
-        __le16 count;
-        u8 eop;
-        u8 credit_group;
-        u8 ra_tid;
-        u8 lmac_offset;
-};
-struct iwm_umac_cmd {
-        u8 id;
-        __le16 count;
-        u8 resp;
-        __le16 seq_num;
-        u8 color;
-};
-struct iwm_lmac_cmd {
-        u8 id;
-        __le16 count;
-        u8 resp;
-        __le16 seq_num;
-};
-struct iwm_nonwifi_cmd {
-        u16 seq_num;
-        bool resp_received;
-        struct list_head pending;
-        struct iwm_udma_nonwifi_cmd udma_cmd;
-        struct iwm_umac_cmd umac_cmd;
-        struct iwm_lmac_cmd lmac_cmd;
-        struct iwm_nonwifi_cmd_buff buf;
-        u32 flags;
-};
-struct iwm_wifi_cmd {
-        u16 seq_num;
-        struct list_head pending;
-        struct iwm_udma_wifi_cmd udma_cmd;
-        struct iwm_umac_cmd umac_cmd;
-        struct iwm_lmac_cmd lmac_cmd;
-        struct iwm_wifi_cmd_buff buf;
-        u32 flags;
-};
-void iwm_cmd_flush(struct iwm_priv *iwm);
-struct iwm_wifi_cmd *iwm_get_pending_wifi_cmd(struct iwm_priv *iwm,
-                                              u16 seq_num);
-struct iwm_nonwifi_cmd *iwm_get_pending_nonwifi_cmd(struct iwm_priv *iwm,
-                                                    u8 seq_num, u8 cmd_opcode);
-int iwm_hal_send_target_cmd(struct iwm_priv *iwm,
-                            struct iwm_udma_nonwifi_cmd *ucmd,
-                            const void *payload);
-int iwm_hal_send_host_cmd(struct iwm_priv *iwm,
-                          struct iwm_udma_wifi_cmd *udma_cmd,
-                          struct iwm_umac_cmd *umac_cmd,
-                          struct iwm_lmac_cmd *lmac_cmd,
-                          const void *payload, u16 payload_size);
-int iwm_hal_send_umac_cmd(struct iwm_priv *iwm,
-                          struct iwm_udma_wifi_cmd *udma_cmd,
-                          struct iwm_umac_cmd *umac_cmd,
-                          const void *payload, u16 payload_size);
-u16 iwm_alloc_wifi_cmd_seq(struct iwm_priv *iwm);
-void iwm_udma_wifi_hdr_set_eop(struct iwm_priv *iwm, u8 *buf, u8 eop);
-void iwm_build_udma_wifi_hdr(struct iwm_priv *iwm,
-                             struct iwm_udma_out_wifi_hdr *hdr,
-                             struct iwm_udma_wifi_cmd *cmd);
-void iwm_build_umac_hdr(struct iwm_priv *iwm,
-                        struct iwm_umac_fw_cmd_hdr *hdr,
-                        struct iwm_umac_cmd *cmd);
-#endif /* _IWM_HAL_H_ */
diff --git a/drivers/net/wireless/iwmc3200wifi/iwm.h b/drivers/net/wireless/iwmc3200wifi/iwm.h
deleted file mode 100644
index 51d7efa15ae6..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/iwm.h
+++ /dev/null
@@ -1,367 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- */
-#ifndef __IWM_H__
-#define __IWM_H__
-#include <linux/netdevice.h>
-#include <linux/wireless.h>
-#include <net/cfg80211.h>
-#include "debug.h"
-#include "hal.h"
-#include "umac.h"
-#include "lmac.h"
-#include "eeprom.h"
-#include "trace.h"
-#define IWM_COPYRIGHT "Copyright(c) 2009 Intel Corporation"
-#define IWM_AUTHOR "<ilw@linux.intel.com>"
-#define IWM_SRC_LMAC    UMAC_HDI_IN_SOURCE_FHRX
-#define IWM_SRC_UDMA    UMAC_HDI_IN_SOURCE_UDMA
-#define IWM_SRC_UMAC    UMAC_HDI_IN_SOURCE_FW
-#define IWM_SRC_NUM     3
-#define IWM_POWER_INDEX_MIN     0
-#define IWM_POWER_INDEX_MAX     5
-#define IWM_POWER_INDEX_DEFAULT 3
-struct iwm_conf {
-        u32 sdio_ior_timeout;
-        unsigned long calib_map;
-        unsigned long expected_calib_map;
-        u8 ct_kill_entry;
-        u8 ct_kill_exit;
-        bool reset_on_fatal_err;
-        bool auto_connect;
-        bool wimax_not_present;
-        bool enable_qos;
-        u32 mode;
-        u32 power_index;
-        u32 frag_threshold;
-        u32 rts_threshold;
-        bool cts_to_self;
-        u32 assoc_timeout;
-        u32 roam_timeout;
-        u32 wireless_mode;
-        u8 ibss_band;
-        u8 ibss_channel;
-        u8 mac_addr[ETH_ALEN];
-};
-enum {
-        COEX_MODE_SA = 1,
-        COEX_MODE_XOR,
-        COEX_MODE_CM,
-        COEX_MODE_MAX,
-};
-struct iwm_if_ops;
-struct iwm_wifi_cmd;
-struct pool_entry {
-        int id;         /* group id */
-        int sid;        /* super group id */
-        int min_pages;  /* min capacity in pages */
-        int max_pages;  /* max capacity in pages */
-        int alloc_pages;        /* allocated # of pages. incresed by driver */
-        int total_freed_pages;  /* total freed # of pages. incresed by UMAC */
-};
-struct spool_entry {
-        int id;
-        int max_pages;
-        int alloc_pages;
-};
-struct iwm_tx_credit {
-        spinlock_t lock;
-        int pool_nr;
-        unsigned long full_pools_map; /* bitmap for # of filled tx pools */
-        struct pool_entry pools[IWM_MACS_OUT_GROUPS];
-        struct spool_entry spools[IWM_MACS_OUT_SGROUPS];
-};
-struct iwm_notif {
-        struct list_head pending;
-        u32 cmd_id;
-        void *cmd;
-        u8 src;
-        void *buf;
-        unsigned long buf_size;
-};
-struct iwm_tid_info {
-        __le16 last_seq_num;
-        bool stopped;
-        struct mutex mutex;
-};
-struct iwm_sta_info {
-        u8 addr[ETH_ALEN];
-        bool valid;
-        bool qos;
-        u8 color;
-        struct iwm_tid_info tid_info[IWM_UMAC_TID_NR];
-};
-struct iwm_tx_info {
-        u8 sta;
-        u8 color;
-        u8 tid;
-};
-struct iwm_rx_info {
-        unsigned long rx_size;
-        unsigned long rx_buf_size;
-};
-#define IWM_NUM_KEYS 4
-struct iwm_umac_key_hdr {
-        u8 mac[ETH_ALEN];
-        u8 key_idx;
-        u8 multicast; /* BCast encrypt & BCast decrypt of frames FROM mac */
-} __packed;
-struct iwm_key {
-        struct iwm_umac_key_hdr hdr;
-        u32 cipher;
-        u8 key[WLAN_MAX_KEY_LEN];
-        u8 seq[IW_ENCODE_SEQ_MAX_SIZE];
-        int key_len;
-        int seq_len;
-};
-#define IWM_RX_ID_HASH  0xff
-#define IWM_RX_ID_GET_HASH(id) ((id) % IWM_RX_ID_HASH)
-#define IWM_STA_TABLE_NUM       16
-#define IWM_TX_LIST_SIZE        64
-#define IWM_RX_LIST_SIZE        256
-#define IWM_SCAN_ID_MAX 0xff
-#define IWM_STATUS_READY                0
-#define IWM_STATUS_SCANNING             1
-#define IWM_STATUS_SCAN_ABORTING        2
-#define IWM_STATUS_SME_CONNECTING       3
-#define IWM_STATUS_ASSOCIATED           4
-#define IWM_STATUS_RESETTING            5
-struct iwm_tx_queue {
-        int id;
-        struct sk_buff_head queue;
-        struct sk_buff_head stopped_queue;
-        spinlock_t lock;
-        struct workqueue_struct *wq;
-        struct work_struct worker;
-        u8 concat_buf[IWM_HAL_CONCATENATE_BUF_SIZE];
-        int concat_count;
-        u8 *concat_ptr;
-};
-/* Queues 0 ~ 3 for AC data, 5 for iPAN */
-#define IWM_TX_QUEUES           5
-#define IWM_TX_DATA_QUEUES      4
-#define IWM_TX_CMD_QUEUE        4
-struct iwm_bss_info {
-        struct list_head node;
-        struct cfg80211_bss *cfg_bss;
-        struct iwm_umac_notif_bss_info *bss;
-};
-typedef int (*iwm_handler)(struct iwm_priv *priv, u8 *buf,
-                           unsigned long buf_size, struct iwm_wifi_cmd *cmd);
-#define IWM_WATCHDOG_PERIOD     (6 * HZ)
-struct iwm_priv {
-        struct wireless_dev *wdev;
-        struct iwm_if_ops *bus_ops;
-        struct iwm_conf conf;
-        unsigned long status;
-        struct list_head pending_notif;
-        wait_queue_head_t notif_queue;
-        wait_queue_head_t nonwifi_queue;
-        unsigned long calib_done_map;
-        struct {
-                u8 *buf;
-                u32 size;
-        } calib_res[CALIBRATION_CMD_NUM];
-        struct iwm_umac_profile *umac_profile;
-        bool umac_profile_active;
-        u8 bssid[ETH_ALEN];
-        u8 channel;
-        u16 rate;
-        u32 txpower;
-        struct iwm_sta_info sta_table[IWM_STA_TABLE_NUM];
-        struct list_head bss_list;
-        void (*nonwifi_rx_handlers[UMAC_HDI_IN_OPCODE_NONWIFI_MAX])
-        (struct iwm_priv *priv, u8 *buf, unsigned long buf_size);
-        const iwm_handler *umac_handlers;
-        const iwm_handler *lmac_handlers;
-        DECLARE_BITMAP(lmac_handler_map, LMAC_COMMAND_ID_NUM);
-        DECLARE_BITMAP(umac_handler_map, LMAC_COMMAND_ID_NUM);
-        DECLARE_BITMAP(udma_handler_map, LMAC_COMMAND_ID_NUM);
-        struct list_head wifi_pending_cmd;
-        struct list_head nonwifi_pending_cmd;
-        u16 wifi_seq_num;
-        u8 nonwifi_seq_num;
-        spinlock_t cmd_lock;
-        u32 core_enabled;
-        u8 scan_id;
-        struct cfg80211_scan_request *scan_request;
-        struct sk_buff_head rx_list;
-        struct list_head rx_tickets;
-        spinlock_t ticket_lock;
-        struct list_head rx_packets[IWM_RX_ID_HASH];
-        spinlock_t packet_lock[IWM_RX_ID_HASH];
-        struct workqueue_struct *rx_wq;
-        struct work_struct rx_worker;
-        struct iwm_tx_credit tx_credit;
-        struct iwm_tx_queue txq[IWM_TX_QUEUES];
-        struct iwm_key keys[IWM_NUM_KEYS];
-        s8 default_key;
-        DECLARE_BITMAP(wifi_ntfy, WIFI_IF_NTFY_MAX);
-        wait_queue_head_t wifi_ntfy_queue;
-        wait_queue_head_t mlme_queue;
-        struct iw_statistics wstats;
-        struct delayed_work stats_request;
-        struct delayed_work disconnect;
-        struct delayed_work ct_kill_delay;
-        struct iwm_debugfs dbg;
-        u8 *eeprom;
-        struct timer_list watchdog;
-        struct work_struct reset_worker;
-        struct work_struct auth_retry_worker;
-        struct mutex mutex;
-        u8 *req_ie;
-        int req_ie_len;
-        u8 *resp_ie;
-        int resp_ie_len;
-        struct iwm_fw_error_hdr *last_fw_err;
-        char umac_version[8];
-        char lmac_version[8];
-        char private[0] __attribute__((__aligned__(NETDEV_ALIGN)));
-};
-static inline void *iwm_private(struct iwm_priv *iwm)
-{
-        BUG_ON(!iwm);
-        return &iwm->private;
-}
-#define hw_to_iwm(h) (h->iwm)
-#define iwm_to_dev(i) (wiphy_dev(i->wdev->wiphy))
-#define iwm_to_wiphy(i) (i->wdev->wiphy)
-#define wiphy_to_iwm(w) (struct iwm_priv *)(wiphy_priv(w))
-#define iwm_to_wdev(i) (i->wdev)
-#define wdev_to_iwm(w) (struct iwm_priv *)(wdev_priv(w))
-#define iwm_to_ndev(i) (i->wdev->netdev)
-#define ndev_to_iwm(n) (wdev_to_iwm(n->ieee80211_ptr))
-#define skb_to_rx_info(s) ((struct iwm_rx_info *)(s->cb))
-#define skb_to_tx_info(s) ((struct iwm_tx_info *)s->cb)
-void *iwm_if_alloc(int sizeof_bus, struct device *dev,
-                   struct iwm_if_ops *if_ops);
-void iwm_if_free(struct iwm_priv *iwm);
-int iwm_if_add(struct iwm_priv *iwm);
-void iwm_if_remove(struct iwm_priv *iwm);
-int iwm_mode_to_nl80211_iftype(int mode);
-int iwm_priv_init(struct iwm_priv *iwm);
-void iwm_priv_deinit(struct iwm_priv *iwm);
-void iwm_reset(struct iwm_priv *iwm);
-void iwm_resetting(struct iwm_priv *iwm);
-void iwm_tx_credit_init_pools(struct iwm_priv *iwm,
-                              struct iwm_umac_notif_alive *alive);
-int iwm_tx_credit_alloc(struct iwm_priv *iwm, int id, int nb);
-int iwm_notif_send(struct iwm_priv *iwm, struct iwm_wifi_cmd *cmd,
-                   u8 cmd_id, u8 source, u8 *buf, unsigned long buf_size);
-int iwm_notif_handle(struct iwm_priv *iwm, u32 cmd, u8 source, long timeout);
-void iwm_init_default_profile(struct iwm_priv *iwm,
-                              struct iwm_umac_profile *profile);
-void iwm_link_on(struct iwm_priv *iwm);
-void iwm_link_off(struct iwm_priv *iwm);
-int iwm_up(struct iwm_priv *iwm);
-int iwm_down(struct iwm_priv *iwm);
-/* TX API */
-int iwm_tid_to_queue(u16 tid);
-void iwm_tx_credit_inc(struct iwm_priv *iwm, int id, int total_freed_pages);
-void iwm_tx_worker(struct work_struct *work);
-int iwm_xmit_frame(struct sk_buff *skb, struct net_device *netdev);
-/* RX API */
-void iwm_rx_setup_handlers(struct iwm_priv *iwm);
-int iwm_rx_handle(struct iwm_priv *iwm, u8 *buf, unsigned long buf_size);
-int iwm_rx_handle_resp(struct iwm_priv *iwm, u8 *buf, unsigned long buf_size,
-                       struct iwm_wifi_cmd *cmd);
-void iwm_rx_free(struct iwm_priv *iwm);
-#endif
diff --git a/drivers/net/wireless/iwmc3200wifi/lmac.h b/drivers/net/wireless/iwmc3200wifi/lmac.h
deleted file mode 100644
index 5ddcdf8c70c0..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/lmac.h
+++ /dev/null
@@ -1,484 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- */
-#ifndef __IWM_LMAC_H__
-#define __IWM_LMAC_H__
-struct iwm_lmac_hdr {
-        u8 id;
-        u8 flags;
-        __le16 seq_num;
-} __packed;
-/* LMAC commands */
-#define CALIB_CFG_FLAG_SEND_COMPLETE_NTFY_AFTER_MSK  0x1
-struct iwm_lmac_cal_cfg_elt {
-        __le32 enable; /* 1 means LMAC needs to do something */
-        __le32 start;  /* 1 to start calibration, 0 to stop */
-        __le32 send_res; /* 1 for sending back results */
-        __le32 apply_res; /* 1 for applying calibration results to HW */
-        __le32 reserved;
-} __packed;
-struct iwm_lmac_cal_cfg_status {
-        struct iwm_lmac_cal_cfg_elt init;
-        struct iwm_lmac_cal_cfg_elt periodic;
-        __le32 flags; /* CALIB_CFG_FLAG_SEND_COMPLETE_NTFY_AFTER_MSK */
-} __packed;
-struct iwm_lmac_cal_cfg_cmd {
-        struct iwm_lmac_cal_cfg_status ucode_cfg;
-        struct iwm_lmac_cal_cfg_status driver_cfg;
-        __le32 reserved;
-} __packed;
-struct iwm_lmac_cal_cfg_resp {
-        __le32 status;
-} __packed;
-#define IWM_CARD_STATE_SW_HW_ENABLED    0x00
-#define IWM_CARD_STATE_HW_DISABLED      0x01
-#define IWM_CARD_STATE_SW_DISABLED      0x02
-#define IWM_CARD_STATE_CTKILL_DISABLED  0x04
-#define IWM_CARD_STATE_IS_RXON          0x10
-struct iwm_lmac_card_state {
-        __le32 flags;
-} __packed;
-/**
- * COEX_PRIORITY_TABLE_CMD
- *
- * Priority entry for each state
- * Will keep two tables, for STA and WIPAN
- */
-enum {
-        /* UN-ASSOCIATION PART */
-        COEX_UNASSOC_IDLE = 0,
-        COEX_UNASSOC_MANUAL_SCAN,
-        COEX_UNASSOC_AUTO_SCAN,
-        /* CALIBRATION */
-        COEX_CALIBRATION,
-        COEX_PERIODIC_CALIBRATION,
-        /* CONNECTION */
-        COEX_CONNECTION_ESTAB,
-        /* ASSOCIATION PART */
-        COEX_ASSOCIATED_IDLE,
-        COEX_ASSOC_MANUAL_SCAN,
-        COEX_ASSOC_AUTO_SCAN,
-        COEX_ASSOC_ACTIVE_LEVEL,
-        /* RF ON/OFF */
-        COEX_RF_ON,
-        COEX_RF_OFF,
-        COEX_STAND_ALONE_DEBUG,
-        /* IPNN */
-        COEX_IPAN_ASSOC_LEVEL,
-        /* RESERVED */
-        COEX_RSRVD1,
-        COEX_RSRVD2,
-        COEX_EVENTS_NUM
-};
-#define COEX_EVT_FLAG_MEDIUM_FREE_NTFY_MSK      0x1
-#define COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_MSK      0x2
-#define COEX_EVT_FLAG_DELAY_MEDIUM_FREE_NTFY_MSK        0x4
-struct coex_event {
-        u8 req_prio;
-        u8 win_med_prio;
-        u8 reserved;
-        u8 flags;
-} __packed;
-#define COEX_FLAGS_STA_TABLE_VALID_MSK          0x1
-#define COEX_FLAGS_UNASSOC_WAKEUP_UMASK_MSK     0x4
-#define COEX_FLAGS_ASSOC_WAKEUP_UMASK_MSK       0x8
-#define COEX_FLAGS_COEX_ENABLE_MSK              0x80
-struct iwm_coex_prio_table_cmd {
-        u8 flags;
-        u8 reserved[3];
-        struct coex_event sta_prio[COEX_EVENTS_NUM];
-} __packed;
-/* Coexistence definitions
- *
- * Constants to fill in the Priorities' Tables
- * RP - Requested Priority
- * WP - Win Medium Priority: priority assigned when the contention has been won
- * FLAGS - Combination of COEX_EVT_FLAG_MEDIUM_FREE_NTFY_MSK and
- *         COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_MSK
- */
-#define COEX_UNASSOC_IDLE_FLAGS         0
-#define COEX_UNASSOC_MANUAL_SCAN_FLAGS  (COEX_EVT_FLAG_MEDIUM_FREE_NTFY_MSK | \
-                                         COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_MSK)
-#define COEX_UNASSOC_AUTO_SCAN_FLAGS    (COEX_EVT_FLAG_MEDIUM_FREE_NTFY_MSK | \
-                                         COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_MSK)
-#define COEX_CALIBRATION_FLAGS          (COEX_EVT_FLAG_MEDIUM_FREE_NTFY_MSK | \
-                                         COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_MSK)
-#define COEX_PERIODIC_CALIBRATION_FLAGS 0
-/* COEX_CONNECTION_ESTAB: we need DELAY_MEDIUM_FREE_NTFY to let WiMAX
- * disconnect from network. */
-#define COEX_CONNECTION_ESTAB_FLAGS (COEX_EVT_FLAG_MEDIUM_FREE_NTFY_MSK | \
-                                     COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_MSK | \
-                                     COEX_EVT_FLAG_DELAY_MEDIUM_FREE_NTFY_MSK)
-#define COEX_ASSOCIATED_IDLE_FLAGS      0
-#define COEX_ASSOC_MANUAL_SCAN_FLAGS    (COEX_EVT_FLAG_MEDIUM_FREE_NTFY_MSK | \
-                                         COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_MSK)
-#define COEX_ASSOC_AUTO_SCAN_FLAGS      (COEX_EVT_FLAG_MEDIUM_FREE_NTFY_MSK | \
-                                         COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_MSK)
-#define COEX_ASSOC_ACTIVE_LEVEL_FLAGS   0
-#define COEX_RF_ON_FLAGS                0
-#define COEX_RF_OFF_FLAGS               0
-#define COEX_STAND_ALONE_DEBUG_FLAGS    (COEX_EVT_FLAG_MEDIUM_FREE_NTFY_MSK | \
-                                         COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_MSK)
-#define COEX_IPAN_ASSOC_LEVEL_FLAGS (COEX_EVT_FLAG_MEDIUM_FREE_NTFY_MSK | \
-                                     COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_MSK | \
-                                     COEX_EVT_FLAG_DELAY_MEDIUM_FREE_NTFY_MSK)
-#define COEX_RSRVD1_FLAGS               0
-#define COEX_RSRVD2_FLAGS               0
-/* XOR_RF_ON is the event wrapping all radio ownership. We need
- * DELAY_MEDIUM_FREE_NTFY to let WiMAX disconnect from network. */
-#define COEX_XOR_RF_ON_FLAGS        (COEX_EVT_FLAG_MEDIUM_FREE_NTFY_MSK | \
-                                     COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_MSK | \
-                                     COEX_EVT_FLAG_DELAY_MEDIUM_FREE_NTFY_MSK)
-/* CT kill config command */
-struct iwm_ct_kill_cfg_cmd {
-        u32 exit_threshold;
-        u32 reserved;
-        u32 entry_threshold;
-} __packed;
-/* LMAC OP CODES */
-#define REPLY_PAD                       0x0
-#define REPLY_ALIVE                     0x1
-#define REPLY_ERROR                     0x2
-#define REPLY_ECHO                      0x3
-#define REPLY_HALT                      0x6
-/* RXON state commands */
-#define REPLY_RX_ON                     0x10
-#define REPLY_RX_ON_ASSOC               0x11
-#define REPLY_RX_OFF                    0x12
-#define REPLY_QOS_PARAM                 0x13
-#define REPLY_RX_ON_TIMING              0x14
-#define REPLY_INTERNAL_QOS_PARAM        0x15
-#define REPLY_RX_INT_TIMEOUT_CNFG       0x16
-#define REPLY_NULL                      0x17
-/* Multi-Station support */
-#define REPLY_ADD_STA                   0x18
-#define REPLY_REMOVE_STA                0x19
-#define REPLY_RESET_ALL_STA             0x1a
-/* RX, TX */
-#define REPLY_ALM_RX                    0x1b
-#define REPLY_TX                        0x1c
-#define REPLY_TXFIFO_FLUSH              0x1e
-/* MISC commands */
-#define REPLY_MGMT_MCAST_KEY            0x1f
-#define REPLY_WEPKEY                    0x20
-#define REPLY_INIT_IV                   0x21
-#define REPLY_WRITE_MIB                 0x22
-#define REPLY_READ_MIB                  0x23
-#define REPLY_RADIO_FE                  0x24
-#define REPLY_TXFIFO_CFG                0x25
-#define REPLY_WRITE_READ                0x26
-#define REPLY_INSTALL_SEC_KEY           0x27
-#define REPLY_RATE_SCALE                0x47
-#define REPLY_LEDS_CMD                  0x48
-#define REPLY_TX_LINK_QUALITY_CMD       0x4e
-#define REPLY_ANA_MIB_OVERRIDE_CMD      0x4f
-#define REPLY_WRITE2REG_CMD             0x50
-/* winfi-wifi coexistence */
-#define COEX_PRIORITY_TABLE_CMD         0x5a
-#define COEX_MEDIUM_NOTIFICATION        0x5b
-#define COEX_EVENT_CMD                  0x5c
-/* more Protocol and Protocol-test commands */
-#define REPLY_MAX_SLEEP_TIME_CMD        0x61
-#define CALIBRATION_CFG_CMD             0x65
-#define CALIBRATION_RES_NOTIFICATION    0x66
-#define CALIBRATION_COMPLETE_NOTIFICATION       0x67
-/* Measurements */
-#define REPLY_QUIET_CMD                 0x71
-#define REPLY_CHANNEL_SWITCH            0x72
-#define CHANNEL_SWITCH_NOTIFICATION     0x73
-#define REPLY_SPECTRUM_MEASUREMENT_CMD  0x74
-#define SPECTRUM_MEASURE_NOTIFICATION   0x75
-#define REPLY_MEASUREMENT_ABORT_CMD     0x76
-/* Power Management */
-#define POWER_TABLE_CMD                 0x77
-#define SAVE_RESTORE_ADDRESS_CMD                0x78
-#define REPLY_WATERMARK_CMD             0x79
-#define PM_DEBUG_STATISTIC_NOTIFIC      0x7B
-#define PD_FLUSH_N_NOTIFICATION         0x7C
-/* Scan commands and notifications */
-#define REPLY_SCAN_REQUEST_CMD          0x80
-#define REPLY_SCAN_ABORT_CMD            0x81
-#define SCAN_START_NOTIFICATION         0x82
-#define SCAN_RESULTS_NOTIFICATION       0x83
-#define SCAN_COMPLETE_NOTIFICATION      0x84
-/* Continuous TX commands */
-#define REPLY_CONT_TX_CMD               0x85
-#define END_OF_CONT_TX_NOTIFICATION     0x86
-/* Timer/Eeprom commands */
-#define TIMER_CMD                       0x87
-#define EEPROM_WRITE_CMD                0x88
-/* PAPD commands */
-#define FEEDBACK_REQUEST_NOTIFICATION   0x8b
-#define REPLY_CW_CMD                    0x8c
-/* IBSS/AP commands Continue */
-#define BEACON_NOTIFICATION             0x90
-#define REPLY_TX_BEACON                 0x91
-#define REPLY_REQUEST_ATIM              0x93
-#define WHO_IS_AWAKE_NOTIFICATION       0x94
-#define TX_PWR_DBM_LIMIT_CMD            0x95
-#define QUIET_NOTIFICATION              0x96
-#define TX_PWR_TABLE_CMD                0x97
-#define TX_ANT_CONFIGURATION_CMD        0x98
-#define MEASURE_ABORT_NOTIFICATION      0x99
-#define REPLY_CALIBRATION_TUNE          0x9a
-/* bt config command */
-#define REPLY_BT_CONFIG                 0x9b
-#define REPLY_STATISTICS_CMD            0x9c
-#define STATISTICS_NOTIFICATION         0x9d
-/* RF-KILL commands and notifications */
-#define REPLY_CARD_STATE_CMD            0xa0
-#define CARD_STATE_NOTIFICATION         0xa1
-/* Missed beacons notification */
-#define MISSED_BEACONS_NOTIFICATION     0xa2
-#define MISSED_BEACONS_NOTIFICATION_TH_CMD      0xa3
-#define REPLY_CT_KILL_CONFIG_CMD        0xa4
-/* HD commands and notifications */
-#define REPLY_HD_PARAMS_CMD             0xa6
-#define HD_PARAMS_NOTIFICATION          0xa7
-#define SENSITIVITY_CMD                 0xa8
-#define U_APSD_PARAMS_CMD               0xa9
-#define NOISY_PLATFORM_CMD              0xaa
-#define ILLEGAL_CMD                     0xac
-#define REPLY_PHY_CALIBRATION_CMD       0xb0
-#define REPLAY_RX_GAIN_CALIB_CMD        0xb1
-/* WiPAN commands */
-#define REPLY_WIPAN_PARAMS_CMD          0xb2
-#define REPLY_WIPAN_RX_ON_CMD           0xb3
-#define REPLY_WIPAN_RX_ON_TIMING        0xb4
-#define REPLY_WIPAN_TX_PWR_TABLE_CMD    0xb5
-#define REPLY_WIPAN_RXON_ASSOC_CMD      0xb6
-#define REPLY_WIPAN_QOS_PARAM           0xb7
-#define WIPAN_REPLY_WEPKEY              0xb8
-/* BeamForming commands */
-#define BEAMFORMER_CFG_CMD              0xba
-#define BEAMFORMEE_NOTIFICATION         0xbb
-/* TGn new Commands */
-#define REPLY_RX_PHY_CMD                0xc0
-#define REPLY_RX_MPDU_CMD               0xc1
-#define REPLY_MULTICAST_HASH            0xc2
-#define REPLY_KDR_RX                    0xc3
-#define REPLY_RX_DSP_EXT_INFO           0xc4
-#define REPLY_COMPRESSED_BA             0xc5
-/* PNC commands */
-#define PNC_CONFIG_CMD                  0xc8
-#define PNC_UPDATE_TABLE_CMD            0xc9
-#define XVT_GENERAL_CTRL_CMD            0xca
-#define REPLY_LEGACY_RADIO_FE           0xdd
-/* WoWLAN commands */
-#define WOWLAN_PATTERNS                 0xe0
-#define WOWLAN_WAKEUP_FILTER            0xe1
-#define WOWLAN_TSC_RSC_PARAM            0xe2
-#define WOWLAN_TKIP_PARAM               0xe3
-#define WOWLAN_KEK_KCK_MATERIAL         0xe4
-#define WOWLAN_GET_STATUSES             0xe5
-#define WOWLAN_TX_POWER_PER_DB          0xe6
-#define REPLY_WOWLAN_GET_STATUSES       WOWLAN_GET_STATUSES
-#define REPLY_DEBUG_CMD                 0xf0
-#define REPLY_DSP_DEBUG_CMD             0xf1
-#define REPLY_DEBUG_MONITOR_CMD         0xf2
-#define REPLY_DEBUG_XVT_CMD             0xf3
-#define REPLY_DEBUG_DC_CALIB            0xf4
-#define REPLY_DYNAMIC_BP                0xf5
-/* General purpose Commands */
-#define REPLY_GP1_CMD                   0xfa
-#define REPLY_GP2_CMD                   0xfb
-#define REPLY_GP3_CMD                   0xfc
-#define REPLY_GP4_CMD                   0xfd
-#define REPLY_REPLAY_WRAPPER            0xfe
-#define REPLY_FRAME_DURATION_CALC_CMD   0xff
-#define LMAC_COMMAND_ID_MAX             0xff
-#define LMAC_COMMAND_ID_NUM             (LMAC_COMMAND_ID_MAX + 1)
-/* Calibration */
-enum {
-        PHY_CALIBRATE_DC_CMD                    = 0,
-        PHY_CALIBRATE_LO_CMD                    = 1,
-        PHY_CALIBRATE_RX_BB_CMD                 = 2,
-        PHY_CALIBRATE_TX_IQ_CMD                 = 3,
-        PHY_CALIBRATE_RX_IQ_CMD                 = 4,
-        PHY_CALIBRATION_NOISE_CMD               = 5,
-        PHY_CALIBRATE_AGC_TABLE_CMD             = 6,
-        PHY_CALIBRATE_CRYSTAL_FRQ_CMD           = 7,
-        PHY_CALIBRATE_OPCODES_NUM,
-        SHILOH_PHY_CALIBRATE_DC_CMD             = 8,
-        SHILOH_PHY_CALIBRATE_LO_CMD             = 9,
-        SHILOH_PHY_CALIBRATE_RX_BB_CMD          = 10,
-        SHILOH_PHY_CALIBRATE_TX_IQ_CMD          = 11,
-        SHILOH_PHY_CALIBRATE_RX_IQ_CMD          = 12,
-        SHILOH_PHY_CALIBRATION_NOISE_CMD        = 13,
-        SHILOH_PHY_CALIBRATE_AGC_TABLE_CMD      = 14,
-        SHILOH_PHY_CALIBRATE_CRYSTAL_FRQ_CMD    = 15,
-        SHILOH_PHY_CALIBRATE_BASE_BAND_CMD      = 16,
-        SHILOH_PHY_CALIBRATE_TXIQ_PERIODIC_CMD  = 17,
-        CALIBRATION_CMD_NUM,
-};
-enum {
-        CALIB_CFG_RX_BB_IDX       = 0,
-        CALIB_CFG_DC_IDX          = 1,
-        CALIB_CFG_LO_IDX          = 2,
-        CALIB_CFG_TX_IQ_IDX       = 3,
-        CALIB_CFG_RX_IQ_IDX       = 4,
-        CALIB_CFG_NOISE_IDX       = 5,
-        CALIB_CFG_CRYSTAL_IDX     = 6,
-        CALIB_CFG_TEMPERATURE_IDX = 7,
-        CALIB_CFG_PAPD_IDX        = 8,
-        CALIB_CFG_LAST_IDX        = CALIB_CFG_PAPD_IDX,
-        CALIB_CFG_MODULE_NUM,
-};
-#define IWM_CALIB_MAP_INIT_MSK          0xFFFF
-#define IWM_CALIB_MAP_PER_LMAC(m)       ((m & 0xFF0000) >> 16)
-#define IWM_CALIB_MAP_PER_UMAC(m)       ((m & 0xFF000000) >> 24)
-#define IWM_CALIB_OPCODE_TO_INDEX(op)   (op - PHY_CALIBRATE_OPCODES_NUM)
-struct iwm_lmac_calib_hdr {
-        u8 opcode;
-        u8 first_grp;
-        u8 grp_num;
-        u8 all_data_valid;
-} __packed;
-#define IWM_LMAC_CALIB_FREQ_GROUPS_NR   7
-#define IWM_CALIB_FREQ_GROUPS_NR        5
-#define IWM_CALIB_DC_MODES_NR           12
-struct iwm_calib_rxiq_entry {
-        u16 ptam_postdist_ars;
-        u16 ptam_postdist_arc;
-} __packed;
-struct iwm_calib_rxiq_group {
-        struct iwm_calib_rxiq_entry mode[IWM_CALIB_DC_MODES_NR];
-} __packed;
-struct iwm_lmac_calib_rxiq {
-        struct iwm_calib_rxiq_group group[IWM_LMAC_CALIB_FREQ_GROUPS_NR];
-} __packed;
-struct iwm_calib_rxiq {
-        struct iwm_lmac_calib_hdr hdr;
-        struct iwm_calib_rxiq_group group[IWM_CALIB_FREQ_GROUPS_NR];
-} __packed;
-#define LMAC_STA_ID_SEED        0x0f
-#define LMAC_STA_ID_POS         0
-#define LMAC_STA_COLOR_SEED     0x7
-#define LMAC_STA_COLOR_POS      4
-struct iwm_lmac_power_report {
-        u8 pa_status;
-        u8 pa_integ_res_A[3];
-        u8 pa_integ_res_B[3];
-        u8 pa_integ_res_C[3];
-} __packed;
-struct iwm_lmac_tx_resp {
-        u8 frame_cnt; /* 1-no aggregation, greater then 1 - aggregation */
-        u8 bt_kill_cnt;
-        __le16 retry_cnt;
-        __le32 initial_tx_rate;
-        __le16 wireless_media_time;
-        struct iwm_lmac_power_report power_report;
-        __le32 tfd_info;
-        __le16 seq_ctl;
-        __le16 byte_cnt;
-        u8 tlc_rate_info;
-        u8 ra_tid;
-        __le16 frame_ctl;
-        __le32 status;
-} __packed;
-#endif
diff --git a/drivers/net/wireless/iwmc3200wifi/main.c b/drivers/net/wireless/iwmc3200wifi/main.c
deleted file mode 100644
index 1f868b166d10..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/main.c
+++ /dev/null
@@ -1,847 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- */
-#include <linux/kernel.h>
-#include <linux/netdevice.h>
-#include <linux/sched.h>
-#include <linux/ieee80211.h>
-#include <linux/wireless.h>
-#include <linux/slab.h>
-#include <linux/moduleparam.h>
-#include "iwm.h"
-#include "debug.h"
-#include "bus.h"
-#include "umac.h"
-#include "commands.h"
-#include "hal.h"
-#include "fw.h"
-#include "rx.h"
-static struct iwm_conf def_iwm_conf = {
-        .sdio_ior_timeout       = 5000,
-        .calib_map              = BIT(CALIB_CFG_DC_IDX) |
-                                  BIT(CALIB_CFG_LO_IDX) |
-                                  BIT(CALIB_CFG_TX_IQ_IDX)      |
-                                  BIT(CALIB_CFG_RX_IQ_IDX)      |
-                                  BIT(SHILOH_PHY_CALIBRATE_BASE_BAND_CMD),
-        .expected_calib_map     = BIT(PHY_CALIBRATE_DC_CMD)     |
-                                  BIT(PHY_CALIBRATE_LO_CMD)     |
-                                  BIT(PHY_CALIBRATE_TX_IQ_CMD)  |
-                                  BIT(PHY_CALIBRATE_RX_IQ_CMD)  |
-                                  BIT(SHILOH_PHY_CALIBRATE_BASE_BAND_CMD),
-        .ct_kill_entry          = 110,
-        .ct_kill_exit           = 110,
-        .reset_on_fatal_err     = 1,
-        .auto_connect           = 1,
-        .enable_qos             = 1,
-        .mode                   = UMAC_MODE_BSS,
-        /* UMAC configuration */
-        .power_index            = 0,
-        .frag_threshold         = IEEE80211_MAX_FRAG_THRESHOLD,
-        .rts_threshold          = IEEE80211_MAX_RTS_THRESHOLD,
-        .cts_to_self            = 0,
-        .assoc_timeout          = 2,
-        .roam_timeout           = 10,
-        .wireless_mode          = WIRELESS_MODE_11A | WIRELESS_MODE_11G |
-                                  WIRELESS_MODE_11N,
-        /* IBSS */
-        .ibss_band              = UMAC_BAND_2GHZ,
-        .ibss_channel           = 1,
-        .mac_addr               = {0x00, 0x02, 0xb3, 0x01, 0x02, 0x03},
-};
-static bool modparam_reset;
-module_param_named(reset, modparam_reset, bool, 0644);
-MODULE_PARM_DESC(reset, "reset on firmware errors (default 0 [not reset])");
-static bool modparam_wimax_enable = true;
-module_param_named(wimax_enable, modparam_wimax_enable, bool, 0644);
-MODULE_PARM_DESC(wimax_enable, "Enable wimax core (default 1 [wimax enabled])");
-int iwm_mode_to_nl80211_iftype(int mode)
-{
-        switch (mode) {
-        case UMAC_MODE_BSS:
-                return NL80211_IFTYPE_STATION;
-        case UMAC_MODE_IBSS:
-                return NL80211_IFTYPE_ADHOC;
-        default:
-                return NL80211_IFTYPE_UNSPECIFIED;
-        }
-        return 0;
-}
-static void iwm_statistics_request(struct work_struct *work)
-{
-        struct iwm_priv *iwm =
-                container_of(work, struct iwm_priv, stats_request.work);
-        iwm_send_umac_stats_req(iwm, 0);
-}
-static void iwm_disconnect_work(struct work_struct *work)
-{
-        struct iwm_priv *iwm =
-                container_of(work, struct iwm_priv, disconnect.work);
-        if (iwm->umac_profile_active)
-                iwm_invalidate_mlme_profile(iwm);
-        clear_bit(IWM_STATUS_ASSOCIATED, &iwm->status);
-        iwm->umac_profile_active = false;
-        memset(iwm->bssid, 0, ETH_ALEN);
-        iwm->channel = 0;
-        iwm_link_off(iwm);
-        wake_up_interruptible(&iwm->mlme_queue);
-        cfg80211_disconnected(iwm_to_ndev(iwm), 0, NULL, 0, GFP_KERNEL);
-}
-static void iwm_ct_kill_work(struct work_struct *work)
-{
-        struct iwm_priv *iwm =
-                container_of(work, struct iwm_priv, ct_kill_delay.work);
-        struct wiphy *wiphy = iwm_to_wiphy(iwm);
-        IWM_INFO(iwm, "CT kill delay timeout\n");
-        wiphy_rfkill_set_hw_state(wiphy, false);
-}
-static int __iwm_up(struct iwm_priv *iwm);
-static int __iwm_down(struct iwm_priv *iwm);
-static void iwm_reset_worker(struct work_struct *work)
-{
-        struct iwm_priv *iwm;
-        struct iwm_umac_profile *profile = NULL;
-        int uninitialized_var(ret), retry = 0;
-        iwm = container_of(work, struct iwm_priv, reset_worker);
-        /*
-         * XXX: The iwm->mutex is introduced purely for this reset work,
-         * because the other users for iwm_up and iwm_down are only netdev
-         * ndo_open and ndo_stop which are already protected by rtnl.
-         * Please remove iwm->mutex together if iwm_reset_worker() is not
-         * required in the future.
-         */
-        if (!mutex_trylock(&iwm->mutex)) {
-                IWM_WARN(iwm, "We are in the middle of interface bringing "
-                         "UP/DOWN. Skip driver resetting.\n");
-                return;
-        }
-        if (iwm->umac_profile_active) {
-                profile = kmalloc(sizeof(struct iwm_umac_profile), GFP_KERNEL);
-                if (profile)
-                        memcpy(profile, iwm->umac_profile, sizeof(*profile));
-                else
-                        IWM_ERR(iwm, "Couldn't alloc memory for profile\n");
-        }
-        __iwm_down(iwm);
-        while (retry++ < 3) {
-                ret = __iwm_up(iwm);
-                if (!ret)
-                        break;
-                schedule_timeout_uninterruptible(10 * HZ);
-        }
-        if (ret) {
-                IWM_WARN(iwm, "iwm_up() failed: %d\n", ret);
-                kfree(profile);
-                goto out;
-        }
-        if (profile) {
-                IWM_DBG_MLME(iwm, DBG, "Resend UMAC profile\n");
-                memcpy(iwm->umac_profile, profile, sizeof(*profile));
-                iwm_send_mlme_profile(iwm);
-                kfree(profile);
-        } else
-                clear_bit(IWM_STATUS_RESETTING, &iwm->status);
- out:
-        mutex_unlock(&iwm->mutex);
-}
-static void iwm_auth_retry_worker(struct work_struct *work)
-{
-        struct iwm_priv *iwm;
-        int i, ret;
-        iwm = container_of(work, struct iwm_priv, auth_retry_worker);
-        if (iwm->umac_profile_active) {
-                ret = iwm_invalidate_mlme_profile(iwm);
-                if (ret < 0)
-                        return;
-        }
-        iwm->umac_profile->sec.auth_type = UMAC_AUTH_TYPE_LEGACY_PSK;
-        ret = iwm_send_mlme_profile(iwm);
-        if (ret < 0)
-                return;
-        for (i = 0; i < IWM_NUM_KEYS; i++)
-                if (iwm->keys[i].key_len)
-                        iwm_set_key(iwm, 0, &iwm->keys[i]);
-        iwm_set_tx_key(iwm, iwm->default_key);
-}
-static void iwm_watchdog(unsigned long data)
-{
-        struct iwm_priv *iwm = (struct iwm_priv *)data;
-        IWM_WARN(iwm, "Watchdog expired: UMAC stalls!\n");
-        if (modparam_reset)
-                iwm_resetting(iwm);
-}
-int iwm_priv_init(struct iwm_priv *iwm)
-{
-        int i, j;
-        char name[32];
-        iwm->status = 0;
-        INIT_LIST_HEAD(&iwm->pending_notif);
-        init_waitqueue_head(&iwm->notif_queue);
-        init_waitqueue_head(&iwm->nonwifi_queue);
-        init_waitqueue_head(&iwm->wifi_ntfy_queue);
-        init_waitqueue_head(&iwm->mlme_queue);
-        memcpy(&iwm->conf, &def_iwm_conf, sizeof(struct iwm_conf));
-        spin_lock_init(&iwm->tx_credit.lock);
-        INIT_LIST_HEAD(&iwm->wifi_pending_cmd);
-        INIT_LIST_HEAD(&iwm->nonwifi_pending_cmd);
-        iwm->wifi_seq_num = UMAC_WIFI_SEQ_NUM_BASE;
-        iwm->nonwifi_seq_num = UMAC_NONWIFI_SEQ_NUM_BASE;
-        spin_lock_init(&iwm->cmd_lock);
-        iwm->scan_id = 1;
-        INIT_DELAYED_WORK(&iwm->stats_request, iwm_statistics_request);
-        INIT_DELAYED_WORK(&iwm->disconnect, iwm_disconnect_work);
-        INIT_DELAYED_WORK(&iwm->ct_kill_delay, iwm_ct_kill_work);
-        INIT_WORK(&iwm->reset_worker, iwm_reset_worker);
-        INIT_WORK(&iwm->auth_retry_worker, iwm_auth_retry_worker);
-        INIT_LIST_HEAD(&iwm->bss_list);
-        skb_queue_head_init(&iwm->rx_list);
-        INIT_LIST_HEAD(&iwm->rx_tickets);
-        spin_lock_init(&iwm->ticket_lock);
-        for (i = 0; i < IWM_RX_ID_HASH; i++) {
-                INIT_LIST_HEAD(&iwm->rx_packets[i]);
-                spin_lock_init(&iwm->packet_lock[i]);
-        }
-        INIT_WORK(&iwm->rx_worker, iwm_rx_worker);
-        iwm->rx_wq = create_singlethread_workqueue(KBUILD_MODNAME "_rx");
-        if (!iwm->rx_wq)
-                return -EAGAIN;
-        for (i = 0; i < IWM_TX_QUEUES; i++) {
-                INIT_WORK(&iwm->txq[i].worker, iwm_tx_worker);
-                snprintf(name, 32, KBUILD_MODNAME "_tx_%d", i);
-                iwm->txq[i].id = i;
-                iwm->txq[i].wq = create_singlethread_workqueue(name);
-                if (!iwm->txq[i].wq)
-                        return -EAGAIN;
-                skb_queue_head_init(&iwm->txq[i].queue);
-                skb_queue_head_init(&iwm->txq[i].stopped_queue);
-                spin_lock_init(&iwm->txq[i].lock);
-        }
-        for (i = 0; i < IWM_NUM_KEYS; i++)
-                memset(&iwm->keys[i], 0, sizeof(struct iwm_key));
-        iwm->default_key = -1;
-        for (i = 0; i < IWM_STA_TABLE_NUM; i++)
-                for (j = 0; j < IWM_UMAC_TID_NR; j++) {
-                        mutex_init(&iwm->sta_table[i].tid_info[j].mutex);
-                        iwm->sta_table[i].tid_info[j].stopped = false;
-                }
-        init_timer(&iwm->watchdog);
-        iwm->watchdog.function = iwm_watchdog;
-        iwm->watchdog.data = (unsigned long)iwm;
-        mutex_init(&iwm->mutex);
-        iwm->last_fw_err = kzalloc(sizeof(struct iwm_fw_error_hdr),
-                                   GFP_KERNEL);
-        if (iwm->last_fw_err == NULL)
-                return -ENOMEM;
-        return 0;
-}
-void iwm_priv_deinit(struct iwm_priv *iwm)
-{
-        int i;
-        for (i = 0; i < IWM_TX_QUEUES; i++)
-                destroy_workqueue(iwm->txq[i].wq);
-        destroy_workqueue(iwm->rx_wq);
-        kfree(iwm->last_fw_err);
-}
-/*
- * We reset all the structures, and we reset the UMAC.
- * After calling this routine, you're expected to reload
- * the firmware.
- */
-void iwm_reset(struct iwm_priv *iwm)
-{
-        struct iwm_notif *notif, *next;
-        if (test_bit(IWM_STATUS_READY, &iwm->status))
-                iwm_target_reset(iwm);
-        if (test_bit(IWM_STATUS_RESETTING, &iwm->status)) {
-                iwm->status = 0;
-                set_bit(IWM_STATUS_RESETTING, &iwm->status);
-        } else
-                iwm->status = 0;
-        iwm->scan_id = 1;
-        list_for_each_entry_safe(notif, next, &iwm->pending_notif, pending) {
-                list_del(&notif->pending);
-                kfree(notif->buf);
-                kfree(notif);
-        }
-        iwm_cmd_flush(iwm);
-        flush_workqueue(iwm->rx_wq);
-        iwm_link_off(iwm);
-}
-void iwm_resetting(struct iwm_priv *iwm)
-{
-        set_bit(IWM_STATUS_RESETTING, &iwm->status);
-        schedule_work(&iwm->reset_worker);
-}
-/*
- * Notification code:
- *
- * We're faced with the following issue: Any host command can
- * have an answer or not, and if there's an answer to expect,
- * it can be treated synchronously or asynchronously.
- * To work around the synchronous answer case, we implemented
- * our notification mechanism.
- * When a code path needs to wait for a command response
- * synchronously, it calls notif_handle(), which waits for the
- * right notification to show up, and then process it. Before
- * starting to wait, it registered as a waiter for this specific
- * answer (by toggling a bit in on of the handler_map), so that
- * the rx code knows that it needs to send a notification to the
- * waiting processes. It does so by calling iwm_notif_send(),
- * which adds the notification to the pending notifications list,
- * and then wakes the waiting processes up.
- */
-int iwm_notif_send(struct iwm_priv *iwm, struct iwm_wifi_cmd *cmd,
-                   u8 cmd_id, u8 source, u8 *buf, unsigned long buf_size)
-{
-        struct iwm_notif *notif;
-        notif = kzalloc(sizeof(struct iwm_notif), GFP_KERNEL);
-        if (!notif) {
-                IWM_ERR(iwm, "Couldn't alloc memory for notification\n");
-                return -ENOMEM;
-        }
-        INIT_LIST_HEAD(&notif->pending);
-        notif->cmd = cmd;
-        notif->cmd_id = cmd_id;
-        notif->src = source;
-        notif->buf = kzalloc(buf_size, GFP_KERNEL);
-        if (!notif->buf) {
-                IWM_ERR(iwm, "Couldn't alloc notification buffer\n");
-                kfree(notif);
-                return -ENOMEM;
-        }
-        notif->buf_size = buf_size;
-        memcpy(notif->buf, buf, buf_size);
-        list_add_tail(&notif->pending, &iwm->pending_notif);
-        wake_up_interruptible(&iwm->notif_queue);
-        return 0;
-}
-static struct iwm_notif *iwm_notif_find(struct iwm_priv *iwm, u32 cmd,
-                                        u8 source)
-{
-        struct iwm_notif *notif;
-        list_for_each_entry(notif, &iwm->pending_notif, pending) {
-                if ((notif->cmd_id == cmd) && (notif->src == source)) {
-                        list_del(&notif->pending);
-                        return notif;
-                }
-        }
-        return NULL;
-}
-static struct iwm_notif *iwm_notif_wait(struct iwm_priv *iwm, u32 cmd,
-                                        u8 source, long timeout)
-{
-        int ret;
-        struct iwm_notif *notif;
-        unsigned long *map = NULL;
-        switch (source) {
-        case IWM_SRC_LMAC:
-                map = &iwm->lmac_handler_map[0];
-                break;
-        case IWM_SRC_UMAC:
-                map = &iwm->umac_handler_map[0];
-                break;
-        case IWM_SRC_UDMA:
-                map = &iwm->udma_handler_map[0];
-                break;
-        }
-        set_bit(cmd, map);
-        ret = wait_event_interruptible_timeout(iwm->notif_queue,
-                         ((notif = iwm_notif_find(iwm, cmd, source)) != NULL),
-                                               timeout);
-        clear_bit(cmd, map);
-        if (!ret)
-                return NULL;
-        return notif;
-}
-int iwm_notif_handle(struct iwm_priv *iwm, u32 cmd, u8 source, long timeout)
-{
-        int ret;
-        struct iwm_notif *notif;
-        notif = iwm_notif_wait(iwm, cmd, source, timeout);
-        if (!notif)
-                return -ETIME;
-        ret = iwm_rx_handle_resp(iwm, notif->buf, notif->buf_size, notif->cmd);
-        kfree(notif->buf);
-        kfree(notif);
-        return ret;
-}
-static int iwm_config_boot_params(struct iwm_priv *iwm)
-{
-        struct iwm_udma_nonwifi_cmd target_cmd;
-        int ret;
-        /* check Wimax is off and config debug monitor */
-        if (!modparam_wimax_enable) {
-                u32 data1 = 0x1f;
-                u32 addr1 = 0x606BE258;
-                u32 data2_set = 0x0;
-                u32 data2_clr = 0x1;
-                u32 addr2 = 0x606BE100;
-                u32 data3 = 0x1;
-                u32 addr3 = 0x606BEC00;
-                target_cmd.resp = 0;
-                target_cmd.handle_by_hw = 0;
-                target_cmd.eop = 1;
-                target_cmd.opcode = UMAC_HDI_OUT_OPCODE_WRITE;
-                target_cmd.addr = cpu_to_le32(addr1);
-                target_cmd.op1_sz = cpu_to_le32(sizeof(u32));
-                target_cmd.op2 = 0;
-                ret = iwm_hal_send_target_cmd(iwm, &target_cmd, &data1);
-                if (ret < 0) {
-                        IWM_ERR(iwm, "iwm_hal_send_target_cmd failed\n");
-                        return ret;
-                }
-                target_cmd.opcode = UMAC_HDI_OUT_OPCODE_READ_MODIFY_WRITE;
-                target_cmd.addr = cpu_to_le32(addr2);
-                target_cmd.op1_sz = cpu_to_le32(data2_set);
-                target_cmd.op2 = cpu_to_le32(data2_clr);
-                ret = iwm_hal_send_target_cmd(iwm, &target_cmd, &data1);
-                if (ret < 0) {
-                        IWM_ERR(iwm, "iwm_hal_send_target_cmd failed\n");
-                        return ret;
-                }
-                target_cmd.opcode = UMAC_HDI_OUT_OPCODE_WRITE;
-                target_cmd.addr = cpu_to_le32(addr3);
-                target_cmd.op1_sz = cpu_to_le32(sizeof(u32));
-                target_cmd.op2 = 0;
-                ret = iwm_hal_send_target_cmd(iwm, &target_cmd, &data3);
-                if (ret < 0) {
-                        IWM_ERR(iwm, "iwm_hal_send_target_cmd failed\n");
-                        return ret;
-                }
-        }
-        return 0;
-}
-void iwm_init_default_profile(struct iwm_priv *iwm,
-                              struct iwm_umac_profile *profile)
-{
-        memset(profile, 0, sizeof(struct iwm_umac_profile));
-        profile->sec.auth_type = UMAC_AUTH_TYPE_OPEN;
-        profile->sec.flags = UMAC_SEC_FLG_LEGACY_PROFILE;
-        profile->sec.ucast_cipher = UMAC_CIPHER_TYPE_NONE;
-        profile->sec.mcast_cipher = UMAC_CIPHER_TYPE_NONE;
-        if (iwm->conf.enable_qos)
-                profile->flags |= cpu_to_le16(UMAC_PROFILE_QOS_ALLOWED);
-        profile->wireless_mode = iwm->conf.wireless_mode;
-        profile->mode = cpu_to_le32(iwm->conf.mode);
-        profile->ibss.atim = 0;
-        profile->ibss.beacon_interval = 100;
-        profile->ibss.join_only = 0;
-        profile->ibss.band = iwm->conf.ibss_band;
-        profile->ibss.channel = iwm->conf.ibss_channel;
-}
-void iwm_link_on(struct iwm_priv *iwm)
-{
-        netif_carrier_on(iwm_to_ndev(iwm));
-        netif_tx_wake_all_queues(iwm_to_ndev(iwm));
-        iwm_send_umac_stats_req(iwm, 0);
-}
-void iwm_link_off(struct iwm_priv *iwm)
-{
-        struct iw_statistics *wstats = &iwm->wstats;
-        int i;
-        netif_tx_stop_all_queues(iwm_to_ndev(iwm));
-        netif_carrier_off(iwm_to_ndev(iwm));
-        for (i = 0; i < IWM_TX_QUEUES; i++) {
-                skb_queue_purge(&iwm->txq[i].queue);
-                skb_queue_purge(&iwm->txq[i].stopped_queue);
-                iwm->txq[i].concat_count = 0;
-                iwm->txq[i].concat_ptr = iwm->txq[i].concat_buf;
-                flush_workqueue(iwm->txq[i].wq);
-        }
-        iwm_rx_free(iwm);
-        cancel_delayed_work_sync(&iwm->stats_request);
-        memset(wstats, 0, sizeof(struct iw_statistics));
-        wstats->qual.updated = IW_QUAL_ALL_INVALID;
-        kfree(iwm->req_ie);
-        iwm->req_ie = NULL;
-        iwm->req_ie_len = 0;
-        kfree(iwm->resp_ie);
-        iwm->resp_ie = NULL;
-        iwm->resp_ie_len = 0;
-        del_timer_sync(&iwm->watchdog);
-}
-static void iwm_bss_list_clean(struct iwm_priv *iwm)
-{
-        struct iwm_bss_info *bss, *next;
-        list_for_each_entry_safe(bss, next, &iwm->bss_list, node) {
-                list_del(&bss->node);
-                kfree(bss->bss);
-                kfree(bss);
-        }
-}
-static int iwm_channels_init(struct iwm_priv *iwm)
-{
-        int ret;
-        ret = iwm_send_umac_channel_list(iwm);
-        if (ret) {
-                IWM_ERR(iwm, "Send channel list failed\n");
-                return ret;
-        }
-        ret = iwm_notif_handle(iwm, UMAC_CMD_OPCODE_GET_CHAN_INFO_LIST,
-                               IWM_SRC_UMAC, WAIT_NOTIF_TIMEOUT);
-        if (ret) {
-                IWM_ERR(iwm, "Didn't get a channel list notification\n");
-                return ret;
-        }
-        return 0;
-}
-static int __iwm_up(struct iwm_priv *iwm)
-{
-        int ret;
-        struct iwm_notif *notif_reboot, *notif_ack = NULL;
-        struct wiphy *wiphy = iwm_to_wiphy(iwm);
-        u32 wireless_mode;
-        ret = iwm_bus_enable(iwm);
-        if (ret) {
-                IWM_ERR(iwm, "Couldn't enable function\n");
-                return ret;
-        }
-        iwm_rx_setup_handlers(iwm);
-        /* Wait for initial BARKER_REBOOT from hardware */
-        notif_reboot = iwm_notif_wait(iwm, IWM_BARKER_REBOOT_NOTIFICATION,
-                                      IWM_SRC_UDMA, 2 * HZ);
-        if (!notif_reboot) {
-                IWM_ERR(iwm, "Wait for REBOOT_BARKER timeout\n");
-                goto err_disable;
-        }
-        /* We send the barker back */
-        ret = iwm_bus_send_chunk(iwm, notif_reboot->buf, 16);
-        if (ret) {
-                IWM_ERR(iwm, "REBOOT barker response failed\n");
-                kfree(notif_reboot);
-                goto err_disable;
-        }
-        kfree(notif_reboot->buf);
-        kfree(notif_reboot);
-        /* Wait for ACK_BARKER from hardware */
-        notif_ack = iwm_notif_wait(iwm, IWM_ACK_BARKER_NOTIFICATION,
-                                   IWM_SRC_UDMA, 2 * HZ);
-        if (!notif_ack) {
-                IWM_ERR(iwm, "Wait for ACK_BARKER timeout\n");
-                goto err_disable;
-        }
-        kfree(notif_ack->buf);
-        kfree(notif_ack);
-        /* We start to config static boot parameters */
-        ret = iwm_config_boot_params(iwm);
-        if (ret) {
-                IWM_ERR(iwm, "Config boot parameters failed\n");
-                goto err_disable;
-        }
-        ret = iwm_read_mac(iwm, iwm_to_ndev(iwm)->dev_addr);
-        if (ret) {
-                IWM_ERR(iwm, "MAC reading failed\n");
-                goto err_disable;
-        }
-        memcpy(iwm_to_ndev(iwm)->perm_addr, iwm_to_ndev(iwm)->dev_addr,
-                ETH_ALEN);
-        /* We can load the FWs */
-        ret = iwm_load_fw(iwm);
-        if (ret) {
-                IWM_ERR(iwm, "FW loading failed\n");
-                goto err_disable;
-        }
-        ret = iwm_eeprom_fat_channels(iwm);
-        if (ret) {
-                IWM_ERR(iwm, "Couldnt read HT channels EEPROM entries\n");
-                goto err_fw;
-        }
-        /*
-         * Read our SKU capabilities.
-         * If it's valid, we AND the configured wireless mode with the
-         * device EEPROM value as the current profile wireless mode.
-         */
-        wireless_mode = iwm_eeprom_wireless_mode(iwm);
-        if (wireless_mode) {
-                iwm->conf.wireless_mode &= wireless_mode;
-                if (iwm->umac_profile)
-                        iwm->umac_profile->wireless_mode =
-                                        iwm->conf.wireless_mode;
-        } else
-                IWM_ERR(iwm, "Wrong SKU capabilities: 0x%x\n",
-                        *((u16 *)iwm_eeprom_access(iwm, IWM_EEPROM_SKU_CAP)));
-        snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "L%s_U%s",
-                 iwm->lmac_version, iwm->umac_version);
-        /* We configure the UMAC and enable the wifi module */
-        ret = iwm_send_umac_config(iwm,
-                        cpu_to_le32(UMAC_RST_CTRL_FLG_WIFI_CORE_EN) |
-                        cpu_to_le32(UMAC_RST_CTRL_FLG_WIFI_LINK_EN) |
-                        cpu_to_le32(UMAC_RST_CTRL_FLG_WIFI_MLME_EN));
-        if (ret) {
-                IWM_ERR(iwm, "UMAC config failed\n");
-                goto err_fw;
-        }
-        ret = iwm_notif_handle(iwm, UMAC_NOTIFY_OPCODE_WIFI_CORE_STATUS,
-                               IWM_SRC_UMAC, WAIT_NOTIF_TIMEOUT);
-        if (ret) {
-                IWM_ERR(iwm, "Didn't get a wifi core status notification\n");
-                goto err_fw;
-        }
-        if (iwm->core_enabled != (UMAC_NTFY_WIFI_CORE_STATUS_LINK_EN |
-                                  UMAC_NTFY_WIFI_CORE_STATUS_MLME_EN)) {
-                IWM_DBG_BOOT(iwm, DBG, "Not all cores enabled:0x%x\n",
-                             iwm->core_enabled);
-                ret = iwm_notif_handle(iwm, UMAC_NOTIFY_OPCODE_WIFI_CORE_STATUS,
-                               IWM_SRC_UMAC, WAIT_NOTIF_TIMEOUT);
-                if (ret) {
-                        IWM_ERR(iwm, "Didn't get a core status notification\n");
-                        goto err_fw;
-                }
-                if (iwm->core_enabled != (UMAC_NTFY_WIFI_CORE_STATUS_LINK_EN |
-                                          UMAC_NTFY_WIFI_CORE_STATUS_MLME_EN)) {
-                        IWM_ERR(iwm, "Not all cores enabled: 0x%x\n",
-                                iwm->core_enabled);
-                        goto err_fw;
-                } else {
-                        IWM_INFO(iwm, "All cores enabled\n");
-                }
-        }
-        ret = iwm_channels_init(iwm);
-        if (ret < 0) {
-                IWM_ERR(iwm, "Couldn't init channels\n");
-                goto err_fw;
-        }
-        /* Set the READY bit to indicate interface is brought up successfully */
-        set_bit(IWM_STATUS_READY, &iwm->status);
-        return 0;
- err_fw:
-        iwm_eeprom_exit(iwm);
- err_disable:
-        ret = iwm_bus_disable(iwm);
-        if (ret < 0)
-                IWM_ERR(iwm, "Couldn't disable function\n");
-        return -EIO;
-}
-int iwm_up(struct iwm_priv *iwm)
-{
-        int ret;
-        mutex_lock(&iwm->mutex);
-        ret = __iwm_up(iwm);
-        mutex_unlock(&iwm->mutex);
-        return ret;
-}
-static int __iwm_down(struct iwm_priv *iwm)
-{
-        int ret;
-        /* The interface is already down */
-        if (!test_bit(IWM_STATUS_READY, &iwm->status))
-                return 0;
-        if (iwm->scan_request) {
-                cfg80211_scan_done(iwm->scan_request, true);
-                iwm->scan_request = NULL;
-        }
-        clear_bit(IWM_STATUS_READY, &iwm->status);
-        iwm_eeprom_exit(iwm);
-        iwm_bss_list_clean(iwm);
-        iwm_init_default_profile(iwm, iwm->umac_profile);
-        iwm->umac_profile_active = false;
-        iwm->default_key = -1;
-        iwm->core_enabled = 0;
-        ret = iwm_bus_disable(iwm);
-        if (ret < 0) {
-                IWM_ERR(iwm, "Couldn't disable function\n");
-                return ret;
-        }
-        return 0;
-}
-int iwm_down(struct iwm_priv *iwm)
-{
-        int ret;
-        mutex_lock(&iwm->mutex);
-        ret = __iwm_down(iwm);
-        mutex_unlock(&iwm->mutex);
-        return ret;
-}
diff --git a/drivers/net/wireless/iwmc3200wifi/netdev.c b/drivers/net/wireless/iwmc3200wifi/netdev.c
deleted file mode 100644
index 5091d77e02ce..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/netdev.c
+++ /dev/null
@@ -1,191 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version
- * 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- *
- */
-/*
- * This is the netdev related hooks for iwm.
- *
- * Some interesting code paths:
- *
- * iwm_open() (Called at netdev interface bringup time)
- *  -> iwm_up() (main.c)
- *      -> iwm_bus_enable()
- *          -> if_sdio_enable() (In case of an SDIO bus)
- *              -> sdio_enable_func()
- *      -> iwm_notif_wait(BARKER_REBOOT) (wait for reboot barker)
- *      -> iwm_notif_wait(ACK_BARKER) (wait for ACK barker)
- *      -> iwm_load_fw() (fw.c)
- *          -> iwm_load_umac()
- *          -> iwm_load_lmac() (Calibration LMAC)
- *          -> iwm_load_lmac() (Operational LMAC)
- *      -> iwm_send_umac_config()
- *
- * iwm_stop() (Called at netdev interface bringdown time)
- *  -> iwm_down()
- *      -> iwm_bus_disable()
- *          -> if_sdio_disable() (In case of an SDIO bus)
- *              -> sdio_disable_func()
- */
-#include <linux/netdevice.h>
-#include <linux/slab.h>
-#include "iwm.h"
-#include "commands.h"
-#include "cfg80211.h"
-#include "debug.h"
-static int iwm_open(struct net_device *ndev)
-{
-        struct iwm_priv *iwm = ndev_to_iwm(ndev);
-        return iwm_up(iwm);
-}
-static int iwm_stop(struct net_device *ndev)
-{
-        struct iwm_priv *iwm = ndev_to_iwm(ndev);
-        return iwm_down(iwm);
-}
-/*
- * iwm AC to queue mapping
- *
- * AC_VO -> queue 3
- * AC_VI -> queue 2
- * AC_BE -> queue 1
- * AC_BK -> queue 0
- */
-static const u16 iwm_1d_to_queue[8] = { 1, 0, 0, 1, 2, 2, 3, 3 };
-int iwm_tid_to_queue(u16 tid)
-{
-        if (tid > IWM_UMAC_TID_NR - 2)
-                return -EINVAL;
-        return iwm_1d_to_queue[tid];
-}
-static u16 iwm_select_queue(struct net_device *dev, struct sk_buff *skb)
-{
-        skb->priority = cfg80211_classify8021d(skb);
-        return iwm_1d_to_queue[skb->priority];
-}
-static const struct net_device_ops iwm_netdev_ops = {
-        .ndo_open               = iwm_open,
-        .ndo_stop               = iwm_stop,
-        .ndo_start_xmit         = iwm_xmit_frame,
-        .ndo_select_queue       = iwm_select_queue,
-};
-void *iwm_if_alloc(int sizeof_bus, struct device *dev,
-                   struct iwm_if_ops *if_ops)
-{
-        struct net_device *ndev;
-        struct wireless_dev *wdev;
-        struct iwm_priv *iwm;
-        int ret = 0;
-        wdev = iwm_wdev_alloc(sizeof_bus, dev);
-        if (IS_ERR(wdev))
-                return wdev;
-        iwm = wdev_to_iwm(wdev);
-        iwm->bus_ops = if_ops;
-        iwm->wdev = wdev;
-        ret = iwm_priv_init(iwm);
-        if (ret) {
-                dev_err(dev, "failed to init iwm_priv\n");
-                goto out_wdev;
-        }
-        wdev->iftype = iwm_mode_to_nl80211_iftype(iwm->conf.mode);
-        ndev = alloc_netdev_mq(0, "wlan%d", ether_setup, IWM_TX_QUEUES);
-        if (!ndev) {
-                dev_err(dev, "no memory for network device instance\n");
-                ret = -ENOMEM;
-                goto out_priv;
-        }
-        ndev->netdev_ops = &iwm_netdev_ops;
-        ndev->ieee80211_ptr = wdev;
-        SET_NETDEV_DEV(ndev, wiphy_dev(wdev->wiphy));
-        wdev->netdev = ndev;
-        iwm->umac_profile = kmalloc(sizeof(struct iwm_umac_profile),
-                                    GFP_KERNEL);
-        if (!iwm->umac_profile) {
-                dev_err(dev, "Couldn't alloc memory for profile\n");
-                ret = -ENOMEM;
-                goto out_profile;
-        }
-        iwm_init_default_profile(iwm, iwm->umac_profile);
-        return iwm;
- out_profile:
-        free_netdev(ndev);
- out_priv:
-        iwm_priv_deinit(iwm);
- out_wdev:
-        iwm_wdev_free(iwm);
-        return ERR_PTR(ret);
-}
-void iwm_if_free(struct iwm_priv *iwm)
-{
-        if (!iwm_to_ndev(iwm))
-                return;
-        cancel_delayed_work_sync(&iwm->ct_kill_delay);
-        free_netdev(iwm_to_ndev(iwm));
-        iwm_priv_deinit(iwm);
-        kfree(iwm->umac_profile);
-        iwm->umac_profile = NULL;
-        iwm_wdev_free(iwm);
-}
-int iwm_if_add(struct iwm_priv *iwm)
-{
-        struct net_device *ndev = iwm_to_ndev(iwm);
-        int ret;
-        ret = register_netdev(ndev);
-        if (ret < 0) {
-                dev_err(&ndev->dev, "Failed to register netdev: %d\n", ret);
-                return ret;
-        }
-        return 0;
-}
-void iwm_if_remove(struct iwm_priv *iwm)
-{
-        unregister_netdev(iwm_to_ndev(iwm));
-}
diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c
deleted file mode 100644
index 7d708f4395f3..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/rx.c
+++ /dev/null
@@ -1,1701 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- */
-#include <linux/kernel.h>
-#include <linux/netdevice.h>
-#include <linux/sched.h>
-#include <linux/etherdevice.h>
-#include <linux/wireless.h>
-#include <linux/ieee80211.h>
-#include <linux/if_arp.h>
-#include <linux/list.h>
-#include <linux/slab.h>
-#include <net/iw_handler.h>
-#include "iwm.h"
-#include "debug.h"
-#include "hal.h"
-#include "umac.h"
-#include "lmac.h"
-#include "commands.h"
-#include "rx.h"
-#include "cfg80211.h"
-#include "eeprom.h"
-static int iwm_rx_check_udma_hdr(struct iwm_udma_in_hdr *hdr)
-{
-        if ((le32_to_cpu(hdr->cmd) == UMAC_PAD_TERMINAL) ||
-            (le32_to_cpu(hdr->size) == UMAC_PAD_TERMINAL))
-                return -EINVAL;
-        return 0;
-}
-static inline int iwm_rx_resp_size(struct iwm_udma_in_hdr *hdr)
-{
-        return ALIGN(le32_to_cpu(hdr->size) + sizeof(struct iwm_udma_in_hdr),
-                     16);
-}
-/*
- * Notification handlers:
- *
- * For every possible notification we can receive from the
- * target, we have a handler.
- * When we get a target notification, and there is no one
- * waiting for it, it's just processed through the rx code
- * path:
- *
- * iwm_rx_handle()
- *  -> iwm_rx_handle_umac()
- *      -> iwm_rx_handle_wifi()
- *          -> iwm_rx_handle_resp()
- *              -> iwm_ntf_*()
- *
- *      OR
- *
- *      -> iwm_rx_handle_non_wifi()
- *
- * If there are processes waiting for this notification, then
- * iwm_rx_handle_wifi() just wakes those processes up and they
- * grab the pending notification.
- */
-static int iwm_ntf_error(struct iwm_priv *iwm, u8 *buf,
-                         unsigned long buf_size, struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_umac_notif_error *error;
-        struct iwm_fw_error_hdr *fw_err;
-        error = (struct iwm_umac_notif_error *)buf;
-        fw_err = &error->err;
-        memcpy(iwm->last_fw_err, fw_err, sizeof(struct iwm_fw_error_hdr));
-        IWM_ERR(iwm, "%cMAC FW ERROR:\n",
-         (le32_to_cpu(fw_err->category) == UMAC_SYS_ERR_CAT_LMAC) ? 'L' : 'U');
-        IWM_ERR(iwm, "\tCategory:    %d\n", le32_to_cpu(fw_err->category));
-        IWM_ERR(iwm, "\tStatus:      0x%x\n", le32_to_cpu(fw_err->status));
-        IWM_ERR(iwm, "\tPC:          0x%x\n", le32_to_cpu(fw_err->pc));
-        IWM_ERR(iwm, "\tblink1:      %d\n", le32_to_cpu(fw_err->blink1));
-        IWM_ERR(iwm, "\tblink2:      %d\n", le32_to_cpu(fw_err->blink2));
-        IWM_ERR(iwm, "\tilink1:      %d\n", le32_to_cpu(fw_err->ilink1));
-        IWM_ERR(iwm, "\tilink2:      %d\n", le32_to_cpu(fw_err->ilink2));
-        IWM_ERR(iwm, "\tData1:       0x%x\n", le32_to_cpu(fw_err->data1));
-        IWM_ERR(iwm, "\tData2:       0x%x\n", le32_to_cpu(fw_err->data2));
-        IWM_ERR(iwm, "\tLine number: %d\n", le32_to_cpu(fw_err->line_num));
-        IWM_ERR(iwm, "\tUMAC status: 0x%x\n", le32_to_cpu(fw_err->umac_status));
-        IWM_ERR(iwm, "\tLMAC status: 0x%x\n", le32_to_cpu(fw_err->lmac_status));
-        IWM_ERR(iwm, "\tSDIO status: 0x%x\n", le32_to_cpu(fw_err->sdio_status));
-        iwm_resetting(iwm);
-        return 0;
-}
-static int iwm_ntf_umac_alive(struct iwm_priv *iwm, u8 *buf,
-                              unsigned long buf_size, struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_umac_notif_alive *alive_resp =
-                        (struct iwm_umac_notif_alive *)(buf);
-        u16 status = le16_to_cpu(alive_resp->status);
-        if (status == UMAC_NTFY_ALIVE_STATUS_ERR) {
-                IWM_ERR(iwm, "Receive error UMAC_ALIVE\n");
-                return -EIO;
-        }
-        iwm_tx_credit_init_pools(iwm, alive_resp);
-        return 0;
-}
-static int iwm_ntf_init_complete(struct iwm_priv *iwm, u8 *buf,
-                                 unsigned long buf_size,
-                                 struct iwm_wifi_cmd *cmd)
-{
-        struct wiphy *wiphy = iwm_to_wiphy(iwm);
-        struct iwm_umac_notif_init_complete *init_complete =
-                        (struct iwm_umac_notif_init_complete *)(buf);
-        u16 status = le16_to_cpu(init_complete->status);
-        bool blocked = (status == UMAC_NTFY_INIT_COMPLETE_STATUS_ERR);
-        if (blocked)
-                IWM_DBG_NTF(iwm, DBG, "Hardware rf kill is on (radio off)\n");
-        else
-                IWM_DBG_NTF(iwm, DBG, "Hardware rf kill is off (radio on)\n");
-        wiphy_rfkill_set_hw_state(wiphy, blocked);
-        return 0;
-}
-static int iwm_ntf_tx_credit_update(struct iwm_priv *iwm, u8 *buf,
-                                    unsigned long buf_size,
-                                    struct iwm_wifi_cmd *cmd)
-{
-        int pool_nr, total_freed_pages;
-        unsigned long pool_map;
-        int i, id;
-        struct iwm_umac_notif_page_dealloc *dealloc =
-                        (struct iwm_umac_notif_page_dealloc *)buf;
-        pool_nr = GET_VAL32(dealloc->changes, UMAC_DEALLOC_NTFY_CHANGES_CNT);
-        pool_map = GET_VAL32(dealloc->changes, UMAC_DEALLOC_NTFY_CHANGES_MSK);
-        IWM_DBG_TX(iwm, DBG, "UMAC dealloc notification: pool nr %d, "
-                   "update map 0x%lx\n", pool_nr, pool_map);
-        spin_lock(&iwm->tx_credit.lock);
-        for (i = 0; i < pool_nr; i++) {
-                id = GET_VAL32(dealloc->grp_info[i],
-                               UMAC_DEALLOC_NTFY_GROUP_NUM);
-                if (test_bit(id, &pool_map)) {
-                        total_freed_pages = GET_VAL32(dealloc->grp_info[i],
-                                              UMAC_DEALLOC_NTFY_PAGE_CNT);
-                        iwm_tx_credit_inc(iwm, id, total_freed_pages);
-                }
-        }
-        spin_unlock(&iwm->tx_credit.lock);
-        return 0;
-}
-static int iwm_ntf_umac_reset(struct iwm_priv *iwm, u8 *buf,
-                              unsigned long buf_size, struct iwm_wifi_cmd *cmd)
-{
-        IWM_DBG_NTF(iwm, DBG, "UMAC RESET done\n");
-        return 0;
-}
-static int iwm_ntf_lmac_version(struct iwm_priv *iwm, u8 *buf,
-                                unsigned long buf_size,
-                                struct iwm_wifi_cmd *cmd)
-{
-        IWM_DBG_NTF(iwm, INFO, "LMAC Version: %x.%x\n", buf[9], buf[8]);
-        return 0;
-}
-static int iwm_ntf_tx(struct iwm_priv *iwm, u8 *buf,
-                      unsigned long buf_size, struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_lmac_tx_resp *tx_resp;
-        struct iwm_umac_wifi_in_hdr *hdr;
-        tx_resp = (struct iwm_lmac_tx_resp *)
-                (buf + sizeof(struct iwm_umac_wifi_in_hdr));
-        hdr = (struct iwm_umac_wifi_in_hdr *)buf;
-        IWM_DBG_TX(iwm, DBG, "REPLY_TX, buf size: %lu\n", buf_size);
-        IWM_DBG_TX(iwm, DBG, "Seqnum: %d\n",
-                   le16_to_cpu(hdr->sw_hdr.cmd.seq_num));
-        IWM_DBG_TX(iwm, DBG, "\tFrame cnt: %d\n", tx_resp->frame_cnt);
-        IWM_DBG_TX(iwm, DBG, "\tRetry cnt: %d\n",
-                   le16_to_cpu(tx_resp->retry_cnt));
-        IWM_DBG_TX(iwm, DBG, "\tSeq ctl: %d\n", le16_to_cpu(tx_resp->seq_ctl));
-        IWM_DBG_TX(iwm, DBG, "\tByte cnt: %d\n",
-                   le16_to_cpu(tx_resp->byte_cnt));
-        IWM_DBG_TX(iwm, DBG, "\tStatus: 0x%x\n", le32_to_cpu(tx_resp->status));
-        return 0;
-}
-static int iwm_ntf_calib_res(struct iwm_priv *iwm, u8 *buf,
-                             unsigned long buf_size, struct iwm_wifi_cmd *cmd)
-{
-        u8 opcode;
-        u8 *calib_buf;
-        struct iwm_lmac_calib_hdr *hdr = (struct iwm_lmac_calib_hdr *)
-                                (buf + sizeof(struct iwm_umac_wifi_in_hdr));
-        opcode = hdr->opcode;
-        BUG_ON(opcode >= CALIBRATION_CMD_NUM ||
-               opcode < PHY_CALIBRATE_OPCODES_NUM);
-        IWM_DBG_NTF(iwm, DBG, "Store calibration result for opcode: %d\n",
-                    opcode);
-        buf_size -= sizeof(struct iwm_umac_wifi_in_hdr);
-        calib_buf = iwm->calib_res[opcode].buf;
-        if (!calib_buf || (iwm->calib_res[opcode].size < buf_size)) {
-                kfree(calib_buf);
-                calib_buf = kzalloc(buf_size, GFP_KERNEL);
-                if (!calib_buf) {
-                        IWM_ERR(iwm, "Memory allocation failed: calib_res\n");
-                        return -ENOMEM;
-                }
-                iwm->calib_res[opcode].buf = calib_buf;
-                iwm->calib_res[opcode].size = buf_size;
-        }
-        memcpy(calib_buf, hdr, buf_size);
-        set_bit(opcode - PHY_CALIBRATE_OPCODES_NUM, &iwm->calib_done_map);
-        return 0;
-}
-static int iwm_ntf_calib_complete(struct iwm_priv *iwm, u8 *buf,
-                                  unsigned long buf_size,
-                                  struct iwm_wifi_cmd *cmd)
-{
-        IWM_DBG_NTF(iwm, DBG, "Calibration completed\n");
-        return 0;
-}
-static int iwm_ntf_calib_cfg(struct iwm_priv *iwm, u8 *buf,
-                             unsigned long buf_size, struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_lmac_cal_cfg_resp *cal_resp;
-        cal_resp = (struct iwm_lmac_cal_cfg_resp *)
-                        (buf + sizeof(struct iwm_umac_wifi_in_hdr));
-        IWM_DBG_NTF(iwm, DBG, "Calibration CFG command status: %d\n",
-                    le32_to_cpu(cal_resp->status));
-        return 0;
-}
-static int iwm_ntf_wifi_status(struct iwm_priv *iwm, u8 *buf,
-                               unsigned long buf_size, struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_umac_notif_wifi_status *status =
-                (struct iwm_umac_notif_wifi_status *)buf;
-        iwm->core_enabled |= le16_to_cpu(status->status);
-        return 0;
-}
-static struct iwm_rx_ticket_node *
-iwm_rx_ticket_node_alloc(struct iwm_priv *iwm, struct iwm_rx_ticket *ticket)
-{
-        struct iwm_rx_ticket_node *ticket_node;
-        ticket_node = kzalloc(sizeof(struct iwm_rx_ticket_node), GFP_KERNEL);
-        if (!ticket_node) {
-                IWM_ERR(iwm, "Couldn't allocate ticket node\n");
-                return ERR_PTR(-ENOMEM);
-        }
-        ticket_node->ticket = kmemdup(ticket, sizeof(struct iwm_rx_ticket),
-                                      GFP_KERNEL);
-        if (!ticket_node->ticket) {
-                IWM_ERR(iwm, "Couldn't allocate RX ticket\n");
-                kfree(ticket_node);
-                return ERR_PTR(-ENOMEM);
-        }
-        INIT_LIST_HEAD(&ticket_node->node);
-        return ticket_node;
-}
-static void iwm_rx_ticket_node_free(struct iwm_rx_ticket_node *ticket_node)
-{
-        kfree(ticket_node->ticket);
-        kfree(ticket_node);
-}
-static struct iwm_rx_packet *iwm_rx_packet_get(struct iwm_priv *iwm, u16 id)
-{
-        u8 id_hash = IWM_RX_ID_GET_HASH(id);
-        struct iwm_rx_packet *packet;
-        spin_lock(&iwm->packet_lock[id_hash]);
-        list_for_each_entry(packet, &iwm->rx_packets[id_hash], node)
-                if (packet->id == id) {
-                        list_del(&packet->node);
-                        spin_unlock(&iwm->packet_lock[id_hash]);
-                        return packet;
-                }
-        spin_unlock(&iwm->packet_lock[id_hash]);
-        return NULL;
-}
-static struct iwm_rx_packet *iwm_rx_packet_alloc(struct iwm_priv *iwm, u8 *buf,
-                                                 u32 size, u16 id)
-{
-        struct iwm_rx_packet *packet;
-        packet = kzalloc(sizeof(struct iwm_rx_packet), GFP_KERNEL);
-        if (!packet) {
-                IWM_ERR(iwm, "Couldn't allocate packet\n");
-                return ERR_PTR(-ENOMEM);
-        }
-        packet->skb = dev_alloc_skb(size);
-        if (!packet->skb) {
-                IWM_ERR(iwm, "Couldn't allocate packet SKB\n");
-                kfree(packet);
-                return ERR_PTR(-ENOMEM);
-        }
-        packet->pkt_size = size;
-        skb_put(packet->skb, size);
-        memcpy(packet->skb->data, buf, size);
-        INIT_LIST_HEAD(&packet->node);
-        packet->id = id;
-        return packet;
-}
-void iwm_rx_free(struct iwm_priv *iwm)
-{
-        struct iwm_rx_ticket_node *ticket, *nt;
-        struct iwm_rx_packet *packet, *np;
-        int i;
-        spin_lock(&iwm->ticket_lock);
-        list_for_each_entry_safe(ticket, nt, &iwm->rx_tickets, node) {
-                list_del(&ticket->node);
-                iwm_rx_ticket_node_free(ticket);
-        }
-        spin_unlock(&iwm->ticket_lock);
-        for (i = 0; i < IWM_RX_ID_HASH; i++) {
-                spin_lock(&iwm->packet_lock[i]);
-                list_for_each_entry_safe(packet, np, &iwm->rx_packets[i],
-                                         node) {
-                        list_del(&packet->node);
-                        kfree_skb(packet->skb);
-                        kfree(packet);
-                }
-                spin_unlock(&iwm->packet_lock[i]);
-        }
-}
-static int iwm_ntf_rx_ticket(struct iwm_priv *iwm, u8 *buf,
-                             unsigned long buf_size, struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_umac_notif_rx_ticket *ntf_rx_ticket =
-                (struct iwm_umac_notif_rx_ticket *)buf;
-        struct iwm_rx_ticket *ticket =
-                (struct iwm_rx_ticket *)ntf_rx_ticket->tickets;
-        int i, schedule_rx = 0;
-        for (i = 0; i < ntf_rx_ticket->num_tickets; i++) {
-                struct iwm_rx_ticket_node *ticket_node;
-                switch (le16_to_cpu(ticket->action)) {
-                case IWM_RX_TICKET_RELEASE:
-                case IWM_RX_TICKET_DROP:
-                        /* We can push the packet to the stack */
-                        ticket_node = iwm_rx_ticket_node_alloc(iwm, ticket);
-                        if (IS_ERR(ticket_node))
-                                return PTR_ERR(ticket_node);
-                        IWM_DBG_RX(iwm, DBG, "TICKET %s(%d)\n",
-                                   __le16_to_cpu(ticket->action) ==
-                                                        IWM_RX_TICKET_RELEASE ?
-                                   "RELEASE" : "DROP",
-                                   ticket->id);
-                        spin_lock(&iwm->ticket_lock);
-                        list_add_tail(&ticket_node->node, &iwm->rx_tickets);
-                        spin_unlock(&iwm->ticket_lock);
-                        /*
-                         * We received an Rx ticket, most likely there's
-                         * a packet pending for it, it's not worth going
-                         * through the packet hash list to double check.
-                         * Let's just fire the rx worker..
-                         */
-                        schedule_rx = 1;
-                        break;
-                default:
-                        IWM_ERR(iwm, "Invalid RX ticket action: 0x%x\n",
-                                ticket->action);
-                }
-                ticket++;
-        }
-        if (schedule_rx)
-                queue_work(iwm->rx_wq, &iwm->rx_worker);
-        return 0;
-}
-static int iwm_ntf_rx_packet(struct iwm_priv *iwm, u8 *buf,
-                             unsigned long buf_size, struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_umac_wifi_in_hdr *wifi_hdr;
-        struct iwm_rx_packet *packet;
-        u16 id, buf_offset;
-        u32 packet_size;
-        u8 id_hash;
-        IWM_DBG_RX(iwm, DBG, "\n");
-        wifi_hdr = (struct iwm_umac_wifi_in_hdr *)buf;
-        id = le16_to_cpu(wifi_hdr->sw_hdr.cmd.seq_num);
-        buf_offset = sizeof(struct iwm_umac_wifi_in_hdr);
-        packet_size = buf_size - sizeof(struct iwm_umac_wifi_in_hdr);
-        IWM_DBG_RX(iwm, DBG, "CMD:0x%x, seqnum: %d, packet size: %d\n",
-                   wifi_hdr->sw_hdr.cmd.cmd, id, packet_size);
-        IWM_DBG_RX(iwm, DBG, "Packet id: %d\n", id);
-        IWM_HEXDUMP(iwm, DBG, RX, "PACKET: ", buf + buf_offset, packet_size);
-        packet = iwm_rx_packet_alloc(iwm, buf + buf_offset, packet_size, id);
-        if (IS_ERR(packet))
-                return PTR_ERR(packet);
-        id_hash = IWM_RX_ID_GET_HASH(id);
-        spin_lock(&iwm->packet_lock[id_hash]);
-        list_add_tail(&packet->node, &iwm->rx_packets[id_hash]);
-        spin_unlock(&iwm->packet_lock[id_hash]);
-        /* We might (unlikely) have received the packet _after_ the ticket */
-        queue_work(iwm->rx_wq, &iwm->rx_worker);
-        return 0;
-}
-/* MLME handlers */
-static int iwm_mlme_assoc_start(struct iwm_priv *iwm, u8 *buf,
-                                unsigned long buf_size,
-                                struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_umac_notif_assoc_start *start;
-        start = (struct iwm_umac_notif_assoc_start *)buf;
-        IWM_DBG_MLME(iwm, INFO, "Association with %pM Started, reason: %d\n",
-                     start->bssid, le32_to_cpu(start->roam_reason));
-        wake_up_interruptible(&iwm->mlme_queue);
-        return 0;
-}
-static u8 iwm_is_open_wep_profile(struct iwm_priv *iwm)
-{
-        if ((iwm->umac_profile->sec.ucast_cipher == UMAC_CIPHER_TYPE_WEP_40 ||
-             iwm->umac_profile->sec.ucast_cipher == UMAC_CIPHER_TYPE_WEP_104) &&
-            (iwm->umac_profile->sec.ucast_cipher ==
-             iwm->umac_profile->sec.mcast_cipher) &&
-            (iwm->umac_profile->sec.auth_type == UMAC_AUTH_TYPE_OPEN))
-               return 1;
-       return 0;
-}
-static int iwm_mlme_assoc_complete(struct iwm_priv *iwm, u8 *buf,
-                                   unsigned long buf_size,
-                                   struct iwm_wifi_cmd *cmd)
-{
-        struct wiphy *wiphy = iwm_to_wiphy(iwm);
-        struct ieee80211_channel *chan;
-        struct iwm_umac_notif_assoc_complete *complete =
-                (struct iwm_umac_notif_assoc_complete *)buf;
-        IWM_DBG_MLME(iwm, INFO, "Association with %pM completed, status: %d\n",
-                     complete->bssid, complete->status);
-        switch (le32_to_cpu(complete->status)) {
-        case UMAC_ASSOC_COMPLETE_SUCCESS:
-                chan = ieee80211_get_channel(wiphy,
-                        ieee80211_channel_to_frequency(complete->channel,
-                                complete->band == UMAC_BAND_2GHZ ?
-                                        IEEE80211_BAND_2GHZ :
-                                        IEEE80211_BAND_5GHZ));
-                if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
-                        /* Associated to a unallowed channel, disassociate. */
-                        __iwm_invalidate_mlme_profile(iwm);
-                        IWM_WARN(iwm, "Couldn't associate with %pM due to "
-                                 "channel %d is disabled. Check your local "
-                                 "regulatory setting.\n",
-                                 complete->bssid, complete->channel);
-                        goto failure;
-                }
-                set_bit(IWM_STATUS_ASSOCIATED, &iwm->status);
-                memcpy(iwm->bssid, complete->bssid, ETH_ALEN);
-                iwm->channel = complete->channel;
-                /* Internal roaming state, avoid notifying SME. */
-                if (!test_and_clear_bit(IWM_STATUS_SME_CONNECTING, &iwm->status)
-                    && iwm->conf.mode == UMAC_MODE_BSS) {
-                        cancel_delayed_work(&iwm->disconnect);
-                        cfg80211_roamed(iwm_to_ndev(iwm), NULL,
-                                        complete->bssid,
-                                        iwm->req_ie, iwm->req_ie_len,
-                                        iwm->resp_ie, iwm->resp_ie_len,
-                                        GFP_KERNEL);
-                        break;
-                }
-                iwm_link_on(iwm);
-                if (iwm->conf.mode == UMAC_MODE_IBSS)
-                        goto ibss;
-                if (!test_bit(IWM_STATUS_RESETTING, &iwm->status))
-                        cfg80211_connect_result(iwm_to_ndev(iwm),
-                                                complete->bssid,
-                                                iwm->req_ie, iwm->req_ie_len,
-                                                iwm->resp_ie, iwm->resp_ie_len,
-                                                WLAN_STATUS_SUCCESS,
-                                                GFP_KERNEL);
-                else
-                        cfg80211_roamed(iwm_to_ndev(iwm), NULL,
-                                        complete->bssid,
-                                        iwm->req_ie, iwm->req_ie_len,
-                                        iwm->resp_ie, iwm->resp_ie_len,
-                                        GFP_KERNEL);
-                break;
-        case UMAC_ASSOC_COMPLETE_FAILURE:
- failure:
-                clear_bit(IWM_STATUS_ASSOCIATED, &iwm->status);
-                memset(iwm->bssid, 0, ETH_ALEN);
-                iwm->channel = 0;
-                /* Internal roaming state, avoid notifying SME. */
-                if (!test_and_clear_bit(IWM_STATUS_SME_CONNECTING, &iwm->status)
-                    && iwm->conf.mode == UMAC_MODE_BSS) {
-                        cancel_delayed_work(&iwm->disconnect);
-                        break;
-                }
-                iwm_link_off(iwm);
-                if (iwm->conf.mode == UMAC_MODE_IBSS)
-                        goto ibss;
-                if (!test_bit(IWM_STATUS_RESETTING, &iwm->status))
-                        if (!iwm_is_open_wep_profile(iwm)) {
-                                cfg80211_connect_result(iwm_to_ndev(iwm),
-                                               complete->bssid,
-                                               NULL, 0, NULL, 0,
-                                               WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                               GFP_KERNEL);
-                        } else {
-                                /* Let's try shared WEP auth */
-                                IWM_ERR(iwm, "Trying WEP shared auth\n");
-                                schedule_work(&iwm->auth_retry_worker);
-                        }
-                else
-                        cfg80211_disconnected(iwm_to_ndev(iwm), 0, NULL, 0,
-                                              GFP_KERNEL);
-                break;
-        default:
-                break;
-        }
-        clear_bit(IWM_STATUS_RESETTING, &iwm->status);
-        return 0;
- ibss:
-        cfg80211_ibss_joined(iwm_to_ndev(iwm), iwm->bssid, GFP_KERNEL);
-        clear_bit(IWM_STATUS_RESETTING, &iwm->status);
-        return 0;
-}
-static int iwm_mlme_profile_invalidate(struct iwm_priv *iwm, u8 *buf,
-                                       unsigned long buf_size,
-                                       struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_umac_notif_profile_invalidate *invalid;
-        u32 reason;
-        invalid = (struct iwm_umac_notif_profile_invalidate *)buf;
-        reason = le32_to_cpu(invalid->reason);
-        IWM_DBG_MLME(iwm, INFO, "Profile Invalidated. Reason: %d\n", reason);
-        if (reason != UMAC_PROFILE_INVALID_REQUEST &&
-            test_bit(IWM_STATUS_SME_CONNECTING, &iwm->status))
-                cfg80211_connect_result(iwm_to_ndev(iwm), NULL, NULL, 0, NULL,
-                                        0, WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                        GFP_KERNEL);
-        clear_bit(IWM_STATUS_SME_CONNECTING, &iwm->status);
-        clear_bit(IWM_STATUS_ASSOCIATED, &iwm->status);
-        iwm->umac_profile_active = false;
-        memset(iwm->bssid, 0, ETH_ALEN);
-        iwm->channel = 0;
-        iwm_link_off(iwm);
-        wake_up_interruptible(&iwm->mlme_queue);
-        return 0;
-}
-#define IWM_DISCONNECT_INTERVAL (5 * HZ)
-static int iwm_mlme_connection_terminated(struct iwm_priv *iwm, u8 *buf,
-                                          unsigned long buf_size,
-                                          struct iwm_wifi_cmd *cmd)
-{
-        IWM_DBG_MLME(iwm, DBG, "Connection terminated\n");
-        schedule_delayed_work(&iwm->disconnect, IWM_DISCONNECT_INTERVAL);
-        return 0;
-}
-static int iwm_mlme_scan_complete(struct iwm_priv *iwm, u8 *buf,
-                                  unsigned long buf_size,
-                                  struct iwm_wifi_cmd *cmd)
-{
-        int ret;
-        struct iwm_umac_notif_scan_complete *scan_complete =
-                (struct iwm_umac_notif_scan_complete *)buf;
-        u32 result = le32_to_cpu(scan_complete->result);
-        IWM_DBG_MLME(iwm, INFO, "type:0x%x result:0x%x seq:%d\n",
-                     le32_to_cpu(scan_complete->type),
-                     le32_to_cpu(scan_complete->result),
-                     scan_complete->seq_num);
-        if (!test_and_clear_bit(IWM_STATUS_SCANNING, &iwm->status)) {
-                IWM_ERR(iwm, "Scan complete while device not scanning\n");
-                return -EIO;
-        }
-        if (!iwm->scan_request)
-                return 0;
-        ret = iwm_cfg80211_inform_bss(iwm);
-        cfg80211_scan_done(iwm->scan_request,
-                           (result & UMAC_SCAN_RESULT_ABORTED) ? 1 : !!ret);
-        iwm->scan_request = NULL;
-        return ret;
-}
-static int iwm_mlme_update_sta_table(struct iwm_priv *iwm, u8 *buf,
-                                     unsigned long buf_size,
-                                     struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_umac_notif_sta_info *umac_sta =
-                        (struct iwm_umac_notif_sta_info *)buf;
-        struct iwm_sta_info *sta;
-        int i;
-        switch (le32_to_cpu(umac_sta->opcode)) {
-        case UMAC_OPCODE_ADD_MODIFY:
-                sta = &iwm->sta_table[GET_VAL8(umac_sta->sta_id, LMAC_STA_ID)];
-                IWM_DBG_MLME(iwm, INFO, "%s STA: ID = %d, Color = %d, "
-                             "addr = %pM, qos = %d\n",
-                             sta->valid ? "Modify" : "Add",
-                             GET_VAL8(umac_sta->sta_id, LMAC_STA_ID),
-                             GET_VAL8(umac_sta->sta_id, LMAC_STA_COLOR),
-                             umac_sta->mac_addr,
-                             umac_sta->flags & UMAC_STA_FLAG_QOS);
-                sta->valid = true;
-                sta->qos = umac_sta->flags & UMAC_STA_FLAG_QOS;
-                sta->color = GET_VAL8(umac_sta->sta_id, LMAC_STA_COLOR);
-                memcpy(sta->addr, umac_sta->mac_addr, ETH_ALEN);
-                break;
-        case UMAC_OPCODE_REMOVE:
-                IWM_DBG_MLME(iwm, INFO, "Remove STA: ID = %d, Color = %d, "
-                             "addr = %pM\n",
-                             GET_VAL8(umac_sta->sta_id, LMAC_STA_ID),
-                             GET_VAL8(umac_sta->sta_id, LMAC_STA_COLOR),
-                             umac_sta->mac_addr);
-                sta = &iwm->sta_table[GET_VAL8(umac_sta->sta_id, LMAC_STA_ID)];
-                if (!memcmp(sta->addr, umac_sta->mac_addr, ETH_ALEN))
-                        sta->valid = false;
-                break;
-        case UMAC_OPCODE_CLEAR_ALL:
-                for (i = 0; i < IWM_STA_TABLE_NUM; i++)
-                        iwm->sta_table[i].valid = false;
-                break;
-        default:
-                break;
-        }
-        return 0;
-}
-static int iwm_mlme_medium_lost(struct iwm_priv *iwm, u8 *buf,
-                                unsigned long buf_size,
-                                struct iwm_wifi_cmd *cmd)
-{
-        struct wiphy *wiphy = iwm_to_wiphy(iwm);
-        IWM_DBG_NTF(iwm, DBG, "WiFi/WiMax coexistence radio is OFF\n");
-        wiphy_rfkill_set_hw_state(wiphy, true);
-        return 0;
-}
-static int iwm_mlme_update_bss_table(struct iwm_priv *iwm, u8 *buf,
-                                     unsigned long buf_size,
-                                     struct iwm_wifi_cmd *cmd)
-{
-        struct wiphy *wiphy = iwm_to_wiphy(iwm);
-        struct ieee80211_mgmt *mgmt;
-        struct iwm_umac_notif_bss_info *umac_bss =
-                        (struct iwm_umac_notif_bss_info *)buf;
-        struct ieee80211_channel *channel;
-        struct ieee80211_supported_band *band;
-        struct iwm_bss_info *bss;
-        s32 signal;
-        int freq;
-        u16 frame_len = le16_to_cpu(umac_bss->frame_len);
-        size_t bss_len = sizeof(struct iwm_umac_notif_bss_info) + frame_len;
-        mgmt = (struct ieee80211_mgmt *)(umac_bss->frame_buf);
-        IWM_DBG_MLME(iwm, DBG, "New BSS info entry: %pM\n", mgmt->bssid);
-        IWM_DBG_MLME(iwm, DBG, "\tType: 0x%x\n", le32_to_cpu(umac_bss->type));
-        IWM_DBG_MLME(iwm, DBG, "\tTimestamp: %d\n",
-                     le32_to_cpu(umac_bss->timestamp));
-        IWM_DBG_MLME(iwm, DBG, "\tTable Index: %d\n",
-                     le16_to_cpu(umac_bss->table_idx));
-        IWM_DBG_MLME(iwm, DBG, "\tBand: %d\n", umac_bss->band);
-        IWM_DBG_MLME(iwm, DBG, "\tChannel: %d\n", umac_bss->channel);
-        IWM_DBG_MLME(iwm, DBG, "\tRSSI: %d\n", umac_bss->rssi);
-        IWM_DBG_MLME(iwm, DBG, "\tFrame Length: %d\n", frame_len);
-        list_for_each_entry(bss, &iwm->bss_list, node)
-                if (bss->bss->table_idx == umac_bss->table_idx)
-                        break;
-        if (&bss->node != &iwm->bss_list) {
-                /* Remove the old BSS entry, we will add it back later. */
-                list_del(&bss->node);
-                kfree(bss->bss);
-        } else {
-                /* New BSS entry */
-                bss = kzalloc(sizeof(struct iwm_bss_info), GFP_KERNEL);
-                if (!bss) {
-                        IWM_ERR(iwm, "Couldn't allocate bss_info\n");
-                        return -ENOMEM;
-                }
-        }
-        bss->bss = kzalloc(bss_len, GFP_KERNEL);
-        if (!bss->bss) {
-                kfree(bss);
-                IWM_ERR(iwm, "Couldn't allocate bss\n");
-                return -ENOMEM;
-        }
-        INIT_LIST_HEAD(&bss->node);
-        memcpy(bss->bss, umac_bss, bss_len);
-        if (umac_bss->band == UMAC_BAND_2GHZ)
-                band = wiphy->bands[IEEE80211_BAND_2GHZ];
-        else if (umac_bss->band == UMAC_BAND_5GHZ)
-                band = wiphy->bands[IEEE80211_BAND_5GHZ];
-        else {
-                IWM_ERR(iwm, "Invalid band: %d\n", umac_bss->band);
-                goto err;
-        }
-        freq = ieee80211_channel_to_frequency(umac_bss->channel, band->band);
-        channel = ieee80211_get_channel(wiphy, freq);
-        signal = umac_bss->rssi * 100;
-        bss->cfg_bss = cfg80211_inform_bss_frame(wiphy, channel,
-                                                 mgmt, frame_len,
-                                                 signal, GFP_KERNEL);
-        if (!bss->cfg_bss)
-                goto err;
-        list_add_tail(&bss->node, &iwm->bss_list);
-        return 0;
- err:
-        kfree(bss->bss);
-        kfree(bss);
-        return -EINVAL;
-}
-static int iwm_mlme_remove_bss(struct iwm_priv *iwm, u8 *buf,
-                               unsigned long buf_size, struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_umac_notif_bss_removed *bss_rm =
-                (struct iwm_umac_notif_bss_removed *)buf;
-        struct iwm_bss_info *bss, *next;
-        u16 table_idx;
-        int i;
-        for (i = 0; i < le32_to_cpu(bss_rm->count); i++) {
-                table_idx = le16_to_cpu(bss_rm->entries[i]) &
-                            IWM_BSS_REMOVE_INDEX_MSK;
-                list_for_each_entry_safe(bss, next, &iwm->bss_list, node)
-                        if (bss->bss->table_idx == cpu_to_le16(table_idx)) {
-                                struct ieee80211_mgmt *mgmt;
-                                mgmt = (struct ieee80211_mgmt *)
-                                        (bss->bss->frame_buf);
-                                IWM_DBG_MLME(iwm, ERR, "BSS removed: %pM\n",
-                                             mgmt->bssid);
-                                list_del(&bss->node);
-                                kfree(bss->bss);
-                                kfree(bss);
-                        }
-        }
-        return 0;
-}
-static int iwm_mlme_mgt_frame(struct iwm_priv *iwm, u8 *buf,
-                              unsigned long buf_size, struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_umac_notif_mgt_frame *mgt_frame =
-                        (struct iwm_umac_notif_mgt_frame *)buf;
-        struct ieee80211_mgmt *mgt = (struct ieee80211_mgmt *)mgt_frame->frame;
-        IWM_HEXDUMP(iwm, DBG, MLME, "MGT: ", mgt_frame->frame,
-                    le16_to_cpu(mgt_frame->len));
-        if (ieee80211_is_assoc_req(mgt->frame_control)) {
-                iwm->req_ie_len = le16_to_cpu(mgt_frame->len)
-                                  - offsetof(struct ieee80211_mgmt,
-                                             u.assoc_req.variable);
-                kfree(iwm->req_ie);
-                iwm->req_ie = kmemdup(mgt->u.assoc_req.variable,
-                                      iwm->req_ie_len, GFP_KERNEL);
-        } else if (ieee80211_is_reassoc_req(mgt->frame_control)) {
-                iwm->req_ie_len = le16_to_cpu(mgt_frame->len)
-                                  - offsetof(struct ieee80211_mgmt,
-                                             u.reassoc_req.variable);
-                kfree(iwm->req_ie);
-                iwm->req_ie = kmemdup(mgt->u.reassoc_req.variable,
-                                      iwm->req_ie_len, GFP_KERNEL);
-        } else if (ieee80211_is_assoc_resp(mgt->frame_control)) {
-                iwm->resp_ie_len = le16_to_cpu(mgt_frame->len)
-                                   - offsetof(struct ieee80211_mgmt,
-                                              u.assoc_resp.variable);
-                kfree(iwm->resp_ie);
-                iwm->resp_ie = kmemdup(mgt->u.assoc_resp.variable,
-                                       iwm->resp_ie_len, GFP_KERNEL);
-        } else if (ieee80211_is_reassoc_resp(mgt->frame_control)) {
-                iwm->resp_ie_len = le16_to_cpu(mgt_frame->len)
-                                   - offsetof(struct ieee80211_mgmt,
-                                              u.reassoc_resp.variable);
-                kfree(iwm->resp_ie);
-                iwm->resp_ie = kmemdup(mgt->u.reassoc_resp.variable,
-                                       iwm->resp_ie_len, GFP_KERNEL);
-        } else {
-                IWM_ERR(iwm, "Unsupported management frame: 0x%x",
-                        le16_to_cpu(mgt->frame_control));
-                return 0;
-        }
-        return 0;
-}
-static int iwm_ntf_mlme(struct iwm_priv *iwm, u8 *buf,
-                        unsigned long buf_size, struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_umac_notif_wifi_if *notif =
-                (struct iwm_umac_notif_wifi_if *)buf;
-        switch (notif->status) {
-        case WIFI_IF_NTFY_ASSOC_START:
-                return iwm_mlme_assoc_start(iwm, buf, buf_size, cmd);
-        case WIFI_IF_NTFY_ASSOC_COMPLETE:
-                return iwm_mlme_assoc_complete(iwm, buf, buf_size, cmd);
-        case WIFI_IF_NTFY_PROFILE_INVALIDATE_COMPLETE:
-                return iwm_mlme_profile_invalidate(iwm, buf, buf_size, cmd);
-        case WIFI_IF_NTFY_CONNECTION_TERMINATED:
-                return iwm_mlme_connection_terminated(iwm, buf, buf_size, cmd);
-        case WIFI_IF_NTFY_SCAN_COMPLETE:
-                return iwm_mlme_scan_complete(iwm, buf, buf_size, cmd);
-        case WIFI_IF_NTFY_STA_TABLE_CHANGE:
-                return iwm_mlme_update_sta_table(iwm, buf, buf_size, cmd);
-        case WIFI_IF_NTFY_EXTENDED_IE_REQUIRED:
-                IWM_DBG_MLME(iwm, DBG, "Extended IE required\n");
-                break;
-        case WIFI_IF_NTFY_RADIO_PREEMPTION:
-                return iwm_mlme_medium_lost(iwm, buf, buf_size, cmd);
-        case WIFI_IF_NTFY_BSS_TRK_TABLE_CHANGED:
-                return iwm_mlme_update_bss_table(iwm, buf, buf_size, cmd);
-        case WIFI_IF_NTFY_BSS_TRK_ENTRIES_REMOVED:
-                return iwm_mlme_remove_bss(iwm, buf, buf_size, cmd);
-                break;
-        case WIFI_IF_NTFY_MGMT_FRAME:
-                return iwm_mlme_mgt_frame(iwm, buf, buf_size, cmd);
-        case WIFI_DBG_IF_NTFY_SCAN_SUPER_JOB_START:
-        case WIFI_DBG_IF_NTFY_SCAN_SUPER_JOB_COMPLETE:
-        case WIFI_DBG_IF_NTFY_SCAN_CHANNEL_START:
-        case WIFI_DBG_IF_NTFY_SCAN_CHANNEL_RESULT:
-        case WIFI_DBG_IF_NTFY_SCAN_MINI_JOB_START:
-        case WIFI_DBG_IF_NTFY_SCAN_MINI_JOB_COMPLETE:
-        case WIFI_DBG_IF_NTFY_CNCT_ATC_START:
-        case WIFI_DBG_IF_NTFY_COEX_NOTIFICATION:
-        case WIFI_DBG_IF_NTFY_COEX_HANDLE_ENVELOP:
-        case WIFI_DBG_IF_NTFY_COEX_HANDLE_RELEASE_ENVELOP:
-                IWM_DBG_MLME(iwm, DBG, "MLME debug notification: 0x%x\n",
-                             notif->status);
-                break;
-        default:
-                IWM_ERR(iwm, "Unhandled notification: 0x%x\n", notif->status);
-                break;
-        }
-        return 0;
-}
-#define IWM_STATS_UPDATE_INTERVAL               (2 * HZ)
-static int iwm_ntf_statistics(struct iwm_priv *iwm, u8 *buf,
-                              unsigned long buf_size, struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_umac_notif_stats *stats = (struct iwm_umac_notif_stats *)buf;
-        struct iw_statistics *wstats = &iwm->wstats;
-        u16 max_rate = 0;
-        int i;
-        IWM_DBG_MLME(iwm, DBG, "Statistics notification received\n");
-        if (test_bit(IWM_STATUS_ASSOCIATED, &iwm->status)) {
-                for (i = 0; i < UMAC_NTF_RATE_SAMPLE_NR; i++) {
-                        max_rate = max_t(u16, max_rate,
-                                         max(le16_to_cpu(stats->tx_rate[i]),
-                                             le16_to_cpu(stats->rx_rate[i])));
-                }
-                /* UMAC passes rate info multiplies by 2 */
-                iwm->rate = max_rate >> 1;
-        }
-        iwm->txpower = le32_to_cpu(stats->tx_power);
-        wstats->status = 0;
-        wstats->discard.nwid = le32_to_cpu(stats->rx_drop_other_bssid);
-        wstats->discard.code = le32_to_cpu(stats->rx_drop_decode);
-        wstats->discard.fragment = le32_to_cpu(stats->rx_drop_reassembly);
-        wstats->discard.retries = le32_to_cpu(stats->tx_drop_max_retry);
-        wstats->miss.beacon = le32_to_cpu(stats->missed_beacons);
-        /* according to cfg80211 */
-        if (stats->rssi_dbm < -110)
-                wstats->qual.qual = 0;
-        else if (stats->rssi_dbm > -40)
-                wstats->qual.qual = 70;
-        else
-                wstats->qual.qual = stats->rssi_dbm + 110;
-        wstats->qual.level = stats->rssi_dbm;
-        wstats->qual.noise = stats->noise_dbm;
-        wstats->qual.updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
-        schedule_delayed_work(&iwm->stats_request, IWM_STATS_UPDATE_INTERVAL);
-        mod_timer(&iwm->watchdog, round_jiffies(jiffies + IWM_WATCHDOG_PERIOD));
-        return 0;
-}
-static int iwm_ntf_eeprom_proxy(struct iwm_priv *iwm, u8 *buf,
-                                unsigned long buf_size,
-                                struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_umac_cmd_eeprom_proxy *eeprom_proxy =
-                (struct iwm_umac_cmd_eeprom_proxy *)
-                (buf + sizeof(struct iwm_umac_wifi_in_hdr));
-        struct iwm_umac_cmd_eeprom_proxy_hdr *hdr = &eeprom_proxy->hdr;
-        u32 hdr_offset = le32_to_cpu(hdr->offset);
-        u32 hdr_len = le32_to_cpu(hdr->len);
-        u32 hdr_type = le32_to_cpu(hdr->type);
-        IWM_DBG_NTF(iwm, DBG, "type: 0x%x, len: %d, offset: 0x%x\n",
-                    hdr_type, hdr_len, hdr_offset);
-        if ((hdr_offset + hdr_len) > IWM_EEPROM_LEN)
-                return -EINVAL;
-        switch (hdr_type) {
-        case IWM_UMAC_CMD_EEPROM_TYPE_READ:
-                memcpy(iwm->eeprom + hdr_offset, eeprom_proxy->buf, hdr_len);
-                break;
-        case IWM_UMAC_CMD_EEPROM_TYPE_WRITE:
-        default:
-                return -ENOTSUPP;
-        }
-        return 0;
-}
-static int iwm_ntf_channel_info_list(struct iwm_priv *iwm, u8 *buf,
-                                     unsigned long buf_size,
-                                     struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_umac_cmd_get_channel_list *ch_list =
-                        (struct iwm_umac_cmd_get_channel_list *)
-                        (buf + sizeof(struct iwm_umac_wifi_in_hdr));
-        struct wiphy *wiphy = iwm_to_wiphy(iwm);
-        struct ieee80211_supported_band *band;
-        int i;
-        band = wiphy->bands[IEEE80211_BAND_2GHZ];
-        for (i = 0; i < band->n_channels; i++) {
-                unsigned long ch_mask_0 =
-                        le32_to_cpu(ch_list->ch[0].channels_mask);
-                unsigned long ch_mask_2 =
-                        le32_to_cpu(ch_list->ch[2].channels_mask);
-                if (!test_bit(i, &ch_mask_0))
-                        band->channels[i].flags |= IEEE80211_CHAN_DISABLED;
-                if (!test_bit(i, &ch_mask_2))
-                        band->channels[i].flags |= IEEE80211_CHAN_NO_IBSS;
-        }
-        band = wiphy->bands[IEEE80211_BAND_5GHZ];
-        for (i = 0; i < min(band->n_channels, 32); i++) {
-                unsigned long ch_mask_1 =
-                        le32_to_cpu(ch_list->ch[1].channels_mask);
-                unsigned long ch_mask_3 =
-                        le32_to_cpu(ch_list->ch[3].channels_mask);
-                if (!test_bit(i, &ch_mask_1))
-                        band->channels[i].flags |= IEEE80211_CHAN_DISABLED;
-                if (!test_bit(i, &ch_mask_3))
-                        band->channels[i].flags |= IEEE80211_CHAN_NO_IBSS;
-        }
-        return 0;
-}
-static int iwm_ntf_stop_resume_tx(struct iwm_priv *iwm, u8 *buf,
-                                  unsigned long buf_size,
-                                  struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_umac_notif_stop_resume_tx *stp_res_tx =
-                (struct iwm_umac_notif_stop_resume_tx *)buf;
-        struct iwm_sta_info *sta_info;
-        struct iwm_tid_info *tid_info;
-        u8 sta_id = STA_ID_N_COLOR_ID(stp_res_tx->sta_id);
-        u16 tid_msk = le16_to_cpu(stp_res_tx->stop_resume_tid_msk);
-        int bit, ret = 0;
-        bool stop = false;
-        IWM_DBG_NTF(iwm, DBG, "stop/resume notification:\n"
-                    "\tflags:       0x%x\n"
-                    "\tSTA id:      %d\n"
-                    "\tTID bitmask: 0x%x\n",
-                    stp_res_tx->flags, stp_res_tx->sta_id,
-                    stp_res_tx->stop_resume_tid_msk);
-        if (stp_res_tx->flags & UMAC_STOP_TX_FLAG)
-                stop = true;
-        sta_info = &iwm->sta_table[sta_id];
-        if (!sta_info->valid) {
-                IWM_ERR(iwm, "Stoping an invalid STA: %d %d\n",
-                        sta_id, stp_res_tx->sta_id);
-                return -EINVAL;
-        }
-        for_each_set_bit(bit, (unsigned long *)&tid_msk, IWM_UMAC_TID_NR) {
-                tid_info = &sta_info->tid_info[bit];
-                mutex_lock(&tid_info->mutex);
-                tid_info->stopped = stop;
-                mutex_unlock(&tid_info->mutex);
-                if (!stop) {
-                        struct iwm_tx_queue *txq;
-                        int queue = iwm_tid_to_queue(bit);
-                        if (queue < 0)
-                                continue;
-                        txq = &iwm->txq[queue];
-                        /*
-                         * If we resume, we have to move our SKBs
-                         * back to the tx queue and queue some work.
-                         */
-                        spin_lock_bh(&txq->lock);
-                        skb_queue_splice_init(&txq->queue, &txq->stopped_queue);
-                        spin_unlock_bh(&txq->lock);
-                        queue_work(txq->wq, &txq->worker);
-                }
-        }
-        /* We send an ACK only for the stop case */
-        if (stop)
-                ret = iwm_send_umac_stop_resume_tx(iwm, stp_res_tx);
-        return ret;
-}
-static int iwm_ntf_wifi_if_wrapper(struct iwm_priv *iwm, u8 *buf,
-                                   unsigned long buf_size,
-                                   struct iwm_wifi_cmd *cmd)
-{
-        struct iwm_umac_wifi_if *hdr;
-        if (cmd == NULL) {
-                IWM_ERR(iwm, "Couldn't find expected wifi command\n");
-                return -EINVAL;
-        }
-        hdr = (struct iwm_umac_wifi_if *)cmd->buf.payload;
-        IWM_DBG_NTF(iwm, DBG, "WIFI_IF_WRAPPER cmd is delivered to UMAC: "
-                    "oid is 0x%x\n", hdr->oid);
-        set_bit(hdr->oid, &iwm->wifi_ntfy[0]);
-        wake_up_interruptible(&iwm->wifi_ntfy_queue);
-        switch (hdr->oid) {
-        case UMAC_WIFI_IF_CMD_SET_PROFILE:
-                iwm->umac_profile_active = true;
-                break;
-        default:
-                break;
-        }
-        return 0;
-}
-#define CT_KILL_DELAY (30 * HZ)
-static int iwm_ntf_card_state(struct iwm_priv *iwm, u8 *buf,
-                              unsigned long buf_size, struct iwm_wifi_cmd *cmd)
-{
-        struct wiphy *wiphy = iwm_to_wiphy(iwm);
-        struct iwm_lmac_card_state *state = (struct iwm_lmac_card_state *)
-                                (buf + sizeof(struct iwm_umac_wifi_in_hdr));
-        u32 flags = le32_to_cpu(state->flags);
-        IWM_INFO(iwm, "HW RF Kill %s, CT Kill %s\n",
-                 flags & IWM_CARD_STATE_HW_DISABLED ? "ON" : "OFF",
-                 flags & IWM_CARD_STATE_CTKILL_DISABLED ? "ON" : "OFF");
-        if (flags & IWM_CARD_STATE_CTKILL_DISABLED) {
-                /*
-                 * We got a CTKILL event: We bring the interface down in
-                 * oder to cool the device down, and try to bring it up
-                 * 30 seconds later. If it's still too hot, we'll go through
-                 * this code path again.
-                 */
-                cancel_delayed_work_sync(&iwm->ct_kill_delay);
-                schedule_delayed_work(&iwm->ct_kill_delay, CT_KILL_DELAY);
-        }
-        wiphy_rfkill_set_hw_state(wiphy, flags &
-                                  (IWM_CARD_STATE_HW_DISABLED |
-                                   IWM_CARD_STATE_CTKILL_DISABLED));
-        return 0;
-}
-static int iwm_rx_handle_wifi(struct iwm_priv *iwm, u8 *buf,
-                              unsigned long buf_size)
-{
-        struct iwm_umac_wifi_in_hdr *wifi_hdr;
-        struct iwm_wifi_cmd *cmd;
-        u8 source, cmd_id;
-        u16 seq_num;
-        u32 count;
-        wifi_hdr = (struct iwm_umac_wifi_in_hdr *)buf;
-        cmd_id = wifi_hdr->sw_hdr.cmd.cmd;
-        source = GET_VAL32(wifi_hdr->hw_hdr.cmd, UMAC_HDI_IN_CMD_SOURCE);
-        if (source >= IWM_SRC_NUM) {
-                IWM_CRIT(iwm, "invalid source %d\n", source);
-                return -EINVAL;
-        }
-        if (cmd_id == REPLY_RX_MPDU_CMD)
-                trace_iwm_rx_packet(iwm, buf, buf_size);
-        else if ((cmd_id == UMAC_NOTIFY_OPCODE_RX_TICKET) &&
-                 (source == UMAC_HDI_IN_SOURCE_FW))
-                trace_iwm_rx_ticket(iwm, buf, buf_size);
-        else
-                trace_iwm_rx_wifi_cmd(iwm, wifi_hdr);
-        count = GET_VAL32(wifi_hdr->sw_hdr.meta_data, UMAC_FW_CMD_BYTE_COUNT);
-        count += sizeof(struct iwm_umac_wifi_in_hdr) -
-                 sizeof(struct iwm_dev_cmd_hdr);
-        if (count > buf_size) {
-                IWM_CRIT(iwm, "count %d, buf size:%ld\n", count, buf_size);
-                return -EINVAL;
-        }
-        seq_num = le16_to_cpu(wifi_hdr->sw_hdr.cmd.seq_num);
-        IWM_DBG_RX(iwm, DBG, "CMD:0x%x, source: 0x%x, seqnum: %d\n",
-                   cmd_id, source, seq_num);
-        /*
-         * If this is a response to a previously sent command, there must
-         * be a pending command for this sequence number.
-         */
-        cmd = iwm_get_pending_wifi_cmd(iwm, seq_num);
-        /* Notify the caller only for sync commands. */
-        switch (source) {
-        case UMAC_HDI_IN_SOURCE_FHRX:
-                if (iwm->lmac_handlers[cmd_id] &&
-                    test_bit(cmd_id, &iwm->lmac_handler_map[0]))
-                        return iwm_notif_send(iwm, cmd, cmd_id, source,
-                                              buf, count);
-                break;
-        case UMAC_HDI_IN_SOURCE_FW:
-                if (iwm->umac_handlers[cmd_id] &&
-                    test_bit(cmd_id, &iwm->umac_handler_map[0]))
-                        return iwm_notif_send(iwm, cmd, cmd_id, source,
-                                              buf, count);
-                break;
-        case UMAC_HDI_IN_SOURCE_UDMA:
-                break;
-        }
-        return iwm_rx_handle_resp(iwm, buf, count, cmd);
-}
-int iwm_rx_handle_resp(struct iwm_priv *iwm, u8 *buf, unsigned long buf_size,
-                       struct iwm_wifi_cmd *cmd)
-{
-        u8 source, cmd_id;
-        struct iwm_umac_wifi_in_hdr *wifi_hdr;
-        int ret = 0;
-        wifi_hdr = (struct iwm_umac_wifi_in_hdr *)buf;
-        cmd_id = wifi_hdr->sw_hdr.cmd.cmd;
-        source = GET_VAL32(wifi_hdr->hw_hdr.cmd, UMAC_HDI_IN_CMD_SOURCE);
-        IWM_DBG_RX(iwm, DBG, "CMD:0x%x, source: 0x%x\n", cmd_id, source);
-        switch (source) {
-        case UMAC_HDI_IN_SOURCE_FHRX:
-                if (iwm->lmac_handlers[cmd_id])
-                        ret = iwm->lmac_handlers[cmd_id]
-                                        (iwm, buf, buf_size, cmd);
-                break;
-        case UMAC_HDI_IN_SOURCE_FW:
-                if (iwm->umac_handlers[cmd_id])
-                        ret = iwm->umac_handlers[cmd_id]
-                                        (iwm, buf, buf_size, cmd);
-                break;
-        case UMAC_HDI_IN_SOURCE_UDMA:
-                ret = -EINVAL;
-                break;
-        }
-        kfree(cmd);
-        return ret;
-}
-static int iwm_rx_handle_nonwifi(struct iwm_priv *iwm, u8 *buf,
-                                 unsigned long buf_size)
-{
-        u8 seq_num;
-        struct iwm_udma_in_hdr *hdr = (struct iwm_udma_in_hdr *)buf;
-        struct iwm_nonwifi_cmd *cmd;
-        trace_iwm_rx_nonwifi_cmd(iwm, buf, buf_size);
-        seq_num = GET_VAL32(hdr->cmd, UDMA_HDI_IN_CMD_NON_WIFI_HW_SEQ_NUM);
-        /*
-         * We received a non wifi answer.
-         * Let's check if there's a pending command for it, and if so
-         * replace the command payload with the buffer, and then wake the
-         * callers up.
-         * That means we only support synchronised non wifi command response
-         * schemes.
-         */
-        list_for_each_entry(cmd, &iwm->nonwifi_pending_cmd, pending)
-                if (cmd->seq_num == seq_num) {
-                        cmd->resp_received = true;
-                        cmd->buf.len = buf_size;
-                        memcpy(cmd->buf.hdr, buf, buf_size);
-                        wake_up_interruptible(&iwm->nonwifi_queue);
-                }
-        return 0;
-}
-static int iwm_rx_handle_umac(struct iwm_priv *iwm, u8 *buf,
-                              unsigned long buf_size)
-{
-        int ret = 0;
-        u8 op_code;
-        unsigned long buf_offset = 0;
-        struct iwm_udma_in_hdr *hdr;
-        /*
-         * To allow for a more efficient bus usage, UMAC
-         * messages are encapsulated into UDMA ones. This
-         * way we can have several UMAC messages in one bus
-         * transfer.
-         * A UDMA frame size is always aligned on 16 bytes,
-         * and a UDMA frame must not start with a UMAC_PAD_TERMINAL
-         * word. This is how we parse a bus frame into several
-         * UDMA ones.
-         */
-        while (buf_offset < buf_size) {
-                hdr = (struct iwm_udma_in_hdr *)(buf + buf_offset);
-                if (iwm_rx_check_udma_hdr(hdr) < 0) {
-                        IWM_DBG_RX(iwm, DBG, "End of frame\n");
-                        break;
-                }
-                op_code = GET_VAL32(hdr->cmd, UMAC_HDI_IN_CMD_OPCODE);
-                IWM_DBG_RX(iwm, DBG, "Op code: 0x%x\n", op_code);
-                if (op_code == UMAC_HDI_IN_OPCODE_WIFI) {
-                        ret |= iwm_rx_handle_wifi(iwm, buf + buf_offset,
-                                                  buf_size - buf_offset);
-                } else if (op_code < UMAC_HDI_IN_OPCODE_NONWIFI_MAX) {
-                        if (GET_VAL32(hdr->cmd,
-                                      UDMA_HDI_IN_CMD_NON_WIFI_HW_SIG) !=
-                            UDMA_HDI_IN_CMD_NON_WIFI_HW_SIG) {
-                                IWM_ERR(iwm, "Incorrect hw signature\n");
-                                return -EINVAL;
-                        }
-                        ret |= iwm_rx_handle_nonwifi(iwm, buf + buf_offset,
-                                                     buf_size - buf_offset);
-                } else {
-                        IWM_ERR(iwm, "Invalid RX opcode: 0x%x\n", op_code);
-                        ret |= -EINVAL;
-                }
-                buf_offset += iwm_rx_resp_size(hdr);
-        }
-        return ret;
-}
-int iwm_rx_handle(struct iwm_priv *iwm, u8 *buf, unsigned long buf_size)
-{
-        struct iwm_udma_in_hdr *hdr;
-        hdr = (struct iwm_udma_in_hdr *)buf;
-        switch (le32_to_cpu(hdr->cmd)) {
-        case UMAC_REBOOT_BARKER:
-                if (test_bit(IWM_STATUS_READY, &iwm->status)) {
-                        IWM_ERR(iwm, "Unexpected BARKER\n");
-                        schedule_work(&iwm->reset_worker);
-                        return 0;
-                }
-                return iwm_notif_send(iwm, NULL, IWM_BARKER_REBOOT_NOTIFICATION,
-                                      IWM_SRC_UDMA, buf, buf_size);
-        case UMAC_ACK_BARKER:
-                return iwm_notif_send(iwm, NULL, IWM_ACK_BARKER_NOTIFICATION,
-                                      IWM_SRC_UDMA, NULL, 0);
-        default:
-                IWM_DBG_RX(iwm, DBG, "Received cmd: 0x%x\n", hdr->cmd);
-                return iwm_rx_handle_umac(iwm, buf, buf_size);
-        }
-        return 0;
-}
-static const iwm_handler iwm_umac_handlers[] =
-{
-        [UMAC_NOTIFY_OPCODE_ERROR]              = iwm_ntf_error,
-        [UMAC_NOTIFY_OPCODE_ALIVE]              = iwm_ntf_umac_alive,
-        [UMAC_NOTIFY_OPCODE_INIT_COMPLETE]      = iwm_ntf_init_complete,
-        [UMAC_NOTIFY_OPCODE_WIFI_CORE_STATUS]   = iwm_ntf_wifi_status,
-        [UMAC_NOTIFY_OPCODE_WIFI_IF_WRAPPER]    = iwm_ntf_mlme,
-        [UMAC_NOTIFY_OPCODE_PAGE_DEALLOC]       = iwm_ntf_tx_credit_update,
-        [UMAC_NOTIFY_OPCODE_RX_TICKET]          = iwm_ntf_rx_ticket,
-        [UMAC_CMD_OPCODE_RESET]                 = iwm_ntf_umac_reset,
-        [UMAC_NOTIFY_OPCODE_STATS]              = iwm_ntf_statistics,
-        [UMAC_CMD_OPCODE_EEPROM_PROXY]          = iwm_ntf_eeprom_proxy,
-        [UMAC_CMD_OPCODE_GET_CHAN_INFO_LIST]    = iwm_ntf_channel_info_list,
-        [UMAC_CMD_OPCODE_STOP_RESUME_STA_TX]    = iwm_ntf_stop_resume_tx,
-        [REPLY_RX_MPDU_CMD]                     = iwm_ntf_rx_packet,
-        [UMAC_CMD_OPCODE_WIFI_IF_WRAPPER]       = iwm_ntf_wifi_if_wrapper,
-};
-static const iwm_handler iwm_lmac_handlers[] =
-{
-        [REPLY_TX]                              = iwm_ntf_tx,
-        [REPLY_ALIVE]                           = iwm_ntf_lmac_version,
-        [CALIBRATION_RES_NOTIFICATION]          = iwm_ntf_calib_res,
-        [CALIBRATION_COMPLETE_NOTIFICATION]     = iwm_ntf_calib_complete,
-        [CALIBRATION_CFG_CMD]                   = iwm_ntf_calib_cfg,
-        [REPLY_RX_MPDU_CMD]                     = iwm_ntf_rx_packet,
-        [CARD_STATE_NOTIFICATION]               = iwm_ntf_card_state,
-};
-void iwm_rx_setup_handlers(struct iwm_priv *iwm)
-{
-        iwm->umac_handlers = (iwm_handler *) iwm_umac_handlers;
-        iwm->lmac_handlers = (iwm_handler *) iwm_lmac_handlers;
-}
-static void iwm_remove_iv(struct sk_buff *skb, u32 hdr_total_len)
-{
-        struct ieee80211_hdr *hdr;
-        unsigned int hdr_len;
-        hdr = (struct ieee80211_hdr *)skb->data;
-        if (!ieee80211_has_protected(hdr->frame_control))
-                return;
-        hdr_len = ieee80211_hdrlen(hdr->frame_control);
-        if (hdr_total_len <= hdr_len)
-                return;
-        memmove(skb->data + (hdr_total_len - hdr_len), skb->data, hdr_len);
-        skb_pull(skb, (hdr_total_len - hdr_len));
-}
-static void iwm_rx_adjust_packet(struct iwm_priv *iwm,
-                                 struct iwm_rx_packet *packet,
-                                 struct iwm_rx_ticket_node *ticket_node)
-{
-        u32 payload_offset = 0, payload_len;
-        struct iwm_rx_ticket *ticket = ticket_node->ticket;
-        struct iwm_rx_mpdu_hdr *mpdu_hdr;
-        struct ieee80211_hdr *hdr;
-        mpdu_hdr = (struct iwm_rx_mpdu_hdr *)packet->skb->data;
-        payload_offset += sizeof(struct iwm_rx_mpdu_hdr);
-        /* Padding is 0 or 2 bytes */
-        payload_len = le16_to_cpu(mpdu_hdr->len) +
-                (le16_to_cpu(ticket->flags) & IWM_RX_TICKET_PAD_SIZE_MSK);
-        payload_len -= ticket->tail_len;
-        IWM_DBG_RX(iwm, DBG, "Packet adjusted, len:%d, offset:%d, "
-                   "ticket offset:%d ticket tail len:%d\n",
-                   payload_len, payload_offset, ticket->payload_offset,
-                   ticket->tail_len);
-        IWM_HEXDUMP(iwm, DBG, RX, "RAW: ", packet->skb->data, packet->skb->len);
-        skb_pull(packet->skb, payload_offset);
-        skb_trim(packet->skb, payload_len);
-        iwm_remove_iv(packet->skb, ticket->payload_offset);
-        hdr = (struct ieee80211_hdr *) packet->skb->data;
-        if (ieee80211_is_data_qos(hdr->frame_control)) {
-                /* UMAC handed QOS_DATA frame with 2 padding bytes appended
-                 * to the qos_ctl field in IEEE 802.11 headers. */
-                memmove(packet->skb->data + IEEE80211_QOS_CTL_LEN + 2,
-                        packet->skb->data,
-                        ieee80211_hdrlen(hdr->frame_control) -
-                        IEEE80211_QOS_CTL_LEN);
-                hdr = (struct ieee80211_hdr *) skb_pull(packet->skb,
-                                IEEE80211_QOS_CTL_LEN + 2);
-                hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
-        }
-        IWM_HEXDUMP(iwm, DBG, RX, "ADJUSTED: ",
-                    packet->skb->data, packet->skb->len);
-}
-static void classify8023(struct sk_buff *skb)
-{
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        if (ieee80211_is_data_qos(hdr->frame_control)) {
-                u8 *qc = ieee80211_get_qos_ctl(hdr);
-                /* frame has qos control */
-                skb->priority = *qc & IEEE80211_QOS_CTL_TID_MASK;
-        } else {
-                skb->priority = 0;
-        }
-}
-static void iwm_rx_process_amsdu(struct iwm_priv *iwm, struct sk_buff *skb)
-{
-        struct wireless_dev *wdev = iwm_to_wdev(iwm);
-        struct net_device *ndev = iwm_to_ndev(iwm);
-        struct sk_buff_head list;
-        struct sk_buff *frame;
-        IWM_HEXDUMP(iwm, DBG, RX, "A-MSDU: ", skb->data, skb->len);
-        __skb_queue_head_init(&list);
-        ieee80211_amsdu_to_8023s(skb, &list, ndev->dev_addr, wdev->iftype, 0,
-                                                                        true);
-        while ((frame = __skb_dequeue(&list))) {
-                ndev->stats.rx_packets++;
-                ndev->stats.rx_bytes += frame->len;
-                frame->protocol = eth_type_trans(frame, ndev);
-                frame->ip_summed = CHECKSUM_NONE;
-                memset(frame->cb, 0, sizeof(frame->cb));
-                if (netif_rx_ni(frame) == NET_RX_DROP) {
-                        IWM_ERR(iwm, "Packet dropped\n");
-                        ndev->stats.rx_dropped++;
-                }
-        }
-}
-static void iwm_rx_process_packet(struct iwm_priv *iwm,
-                                  struct iwm_rx_packet *packet,
-                                  struct iwm_rx_ticket_node *ticket_node)
-{
-        int ret;
-        struct sk_buff *skb = packet->skb;
-        struct wireless_dev *wdev = iwm_to_wdev(iwm);
-        struct net_device *ndev = iwm_to_ndev(iwm);
-        IWM_DBG_RX(iwm, DBG, "Processing packet ID %d\n", packet->id);
-        switch (le16_to_cpu(ticket_node->ticket->action)) {
-        case IWM_RX_TICKET_RELEASE:
-                IWM_DBG_RX(iwm, DBG, "RELEASE packet\n");
-                iwm_rx_adjust_packet(iwm, packet, ticket_node);
-                skb->dev = iwm_to_ndev(iwm);
-                classify8023(skb);
-                if (le16_to_cpu(ticket_node->ticket->flags) &
-                    IWM_RX_TICKET_AMSDU_MSK) {
-                        iwm_rx_process_amsdu(iwm, skb);
-                        break;
-                }
-                ret = ieee80211_data_to_8023(skb, ndev->dev_addr, wdev->iftype);
-                if (ret < 0) {
-                        IWM_DBG_RX(iwm, DBG, "Couldn't convert 802.11 header - "
-                                   "%d\n", ret);
-                        kfree_skb(packet->skb);
-                        break;
-                }
-                IWM_HEXDUMP(iwm, DBG, RX, "802.3: ", skb->data, skb->len);
-                ndev->stats.rx_packets++;
-                ndev->stats.rx_bytes += skb->len;
-                skb->protocol = eth_type_trans(skb, ndev);
-                skb->ip_summed = CHECKSUM_NONE;
-                memset(skb->cb, 0, sizeof(skb->cb));
-                if (netif_rx_ni(skb) == NET_RX_DROP) {
-                        IWM_ERR(iwm, "Packet dropped\n");
-                        ndev->stats.rx_dropped++;
-                }
-                break;
-        case IWM_RX_TICKET_DROP:
-                IWM_DBG_RX(iwm, DBG, "DROP packet: 0x%x\n",
-                           le16_to_cpu(ticket_node->ticket->flags));
-                kfree_skb(packet->skb);
-                break;
-        default:
-                IWM_ERR(iwm, "Unknown ticket action: %d\n",
-                        le16_to_cpu(ticket_node->ticket->action));
-                kfree_skb(packet->skb);
-        }
-        kfree(packet);
-        iwm_rx_ticket_node_free(ticket_node);
-}
-/*
- * Rx data processing:
- *
- * We're receiving Rx packet from the LMAC, and Rx ticket from
- * the UMAC.
- * To forward a target data packet upstream (i.e. to the
- * kernel network stack), we must have received an Rx ticket
- * that tells us we're allowed to release this packet (ticket
- * action is IWM_RX_TICKET_RELEASE). The Rx ticket also indicates,
- * among other things, where valid data actually starts in the Rx
- * packet.
- */
-void iwm_rx_worker(struct work_struct *work)
-{
-        struct iwm_priv *iwm;
-        struct iwm_rx_ticket_node *ticket, *next;
-        iwm = container_of(work, struct iwm_priv, rx_worker);
-        /*
-         * We go through the tickets list and if there is a pending
-         * packet for it, we push it upstream.
-         * We stop whenever a ticket is missing its packet, as we're
-         * supposed to send the packets in order.
-         */
-        spin_lock(&iwm->ticket_lock);
-        list_for_each_entry_safe(ticket, next, &iwm->rx_tickets, node) {
-                struct iwm_rx_packet *packet =
-                        iwm_rx_packet_get(iwm, le16_to_cpu(ticket->ticket->id));
-                if (!packet) {
-                        IWM_DBG_RX(iwm, DBG, "Skip rx_work: Wait for ticket %d "
-                                   "to be handled first\n",
-                                   le16_to_cpu(ticket->ticket->id));
-                        break;
-                }
-                list_del(&ticket->node);
-                iwm_rx_process_packet(iwm, packet, ticket);
-        }
-        spin_unlock(&iwm->ticket_lock);
-}
diff --git a/drivers/net/wireless/iwmc3200wifi/rx.h b/drivers/net/wireless/iwmc3200wifi/rx.h
deleted file mode 100644
index da0db91cee59..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/rx.h
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- */
-#ifndef __IWM_RX_H__
-#define __IWM_RX_H__
-#include <linux/skbuff.h>
-#include "umac.h"
-struct iwm_rx_ticket_node {
-        struct list_head node;
-        struct iwm_rx_ticket *ticket;
-};
-struct iwm_rx_packet {
-        struct list_head node;
-        u16 id;
-        struct sk_buff *skb;
-        unsigned long pkt_size;
-};
-void iwm_rx_worker(struct work_struct *work);
-#endif
diff --git a/drivers/net/wireless/iwmc3200wifi/sdio.c b/drivers/net/wireless/iwmc3200wifi/sdio.c
deleted file mode 100644
index 0042f204b07f..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/sdio.c
+++ /dev/null
@@ -1,509 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- */
-/*
- * This is the SDIO bus specific hooks for iwm.
- * It also is the module's entry point.
- *
- * Interesting code paths:
- * iwm_sdio_probe() (Called by an SDIO bus scan)
- *  -> iwm_if_alloc() (netdev.c)
- *      -> iwm_wdev_alloc() (cfg80211.c, allocates and register our wiphy)
- *          -> wiphy_new()
- *          -> wiphy_register()
- *      -> alloc_netdev_mq()
- *      -> register_netdev()
- *
- * iwm_sdio_remove()
- *  -> iwm_if_free() (netdev.c)
- *      -> unregister_netdev()
- *      -> iwm_wdev_free() (cfg80211.c)
- *          -> wiphy_unregister()
- *          -> wiphy_free()
- *
- * iwm_sdio_isr() (called in process context from the SDIO core code)
- *  -> queue_work(.., isr_worker)
- *      -- [async] --> iwm_sdio_isr_worker()
- *                      -> iwm_rx_handle()
- */
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/slab.h>
-#include <linux/netdevice.h>
-#include <linux/debugfs.h>
-#include <linux/mmc/sdio_ids.h>
-#include <linux/mmc/sdio.h>
-#include <linux/mmc/sdio_func.h>
-#include "iwm.h"
-#include "debug.h"
-#include "bus.h"
-#include "sdio.h"
-static void iwm_sdio_isr_worker(struct work_struct *work)
-{
-        struct iwm_sdio_priv *hw;
-        struct iwm_priv *iwm;
-        struct iwm_rx_info *rx_info;
-        struct sk_buff *skb;
-        u8 *rx_buf;
-        unsigned long rx_size;
-        hw = container_of(work, struct iwm_sdio_priv, isr_worker);
-        iwm = hw_to_iwm(hw);
-        while (!skb_queue_empty(&iwm->rx_list)) {
-                skb = skb_dequeue(&iwm->rx_list);
-                rx_info = skb_to_rx_info(skb);
-                rx_size = rx_info->rx_size;
-                rx_buf = skb->data;
-                IWM_HEXDUMP(iwm, DBG, SDIO, "RX: ", rx_buf, rx_size);
-                if (iwm_rx_handle(iwm, rx_buf, rx_size) < 0)
-                        IWM_WARN(iwm, "RX error\n");
-                kfree_skb(skb);
-        }
-}
-static void iwm_sdio_isr(struct sdio_func *func)
-{
-        struct iwm_priv *iwm;
-        struct iwm_sdio_priv *hw;
-        struct iwm_rx_info *rx_info;
-        struct sk_buff *skb;
-        unsigned long buf_size, read_size;
-        int ret;
-        u8 val;
-        hw = sdio_get_drvdata(func);
-        iwm = hw_to_iwm(hw);
-        buf_size = hw->blk_size;
-        /* We're checking the status */
-        val = sdio_readb(func, IWM_SDIO_INTR_STATUS_ADDR, &ret);
-        if (val == 0 || ret < 0) {
-                IWM_ERR(iwm, "Wrong INTR_STATUS\n");
-                return;
-        }
-        /* See if we have free buffers */
-        if (skb_queue_len(&iwm->rx_list) > IWM_RX_LIST_SIZE) {
-                IWM_ERR(iwm, "No buffer for more Rx frames\n");
-                return;
-        }
-        /* We first read the transaction size */
-        read_size = sdio_readb(func, IWM_SDIO_INTR_GET_SIZE_ADDR + 1, &ret);
-        read_size = read_size << 8;
-        if (ret < 0) {
-                IWM_ERR(iwm, "Couldn't read the xfer size\n");
-                return;
-        }
-        /* We need to clear the INT register */
-        sdio_writeb(func, 1, IWM_SDIO_INTR_CLEAR_ADDR, &ret);
-        if (ret < 0) {
-                IWM_ERR(iwm, "Couldn't clear the INT register\n");
-                return;
-        }
-        while (buf_size < read_size)
-                buf_size <<= 1;
-        skb = dev_alloc_skb(buf_size);
-        if (!skb) {
-                IWM_ERR(iwm, "Couldn't alloc RX skb\n");
-                return;
-        }
-        rx_info = skb_to_rx_info(skb);
-        rx_info->rx_size = read_size;
-        rx_info->rx_buf_size = buf_size;
-        /* Now we can read the actual buffer */
-        ret = sdio_memcpy_fromio(func, skb_put(skb, read_size),
-                                 IWM_SDIO_DATA_ADDR, read_size);
-        /* The skb is put on a driver's specific Rx SKB list */
-        skb_queue_tail(&iwm->rx_list, skb);
-        /* We can now schedule the actual worker */
-        queue_work(hw->isr_wq, &hw->isr_worker);
-}
-static void iwm_sdio_rx_free(struct iwm_sdio_priv *hw)
-{
-        struct iwm_priv *iwm = hw_to_iwm(hw);
-        flush_workqueue(hw->isr_wq);
-        skb_queue_purge(&iwm->rx_list);
-}
-/* Bus ops */
-static int if_sdio_enable(struct iwm_priv *iwm)
-{
-        struct iwm_sdio_priv *hw = iwm_to_if_sdio(iwm);
-        int ret;
-        sdio_claim_host(hw->func);
-        ret = sdio_enable_func(hw->func);
-        if (ret) {
-                IWM_ERR(iwm, "Couldn't enable the device: is TOP driver "
-                        "loaded and functional?\n");
-                goto release_host;
-        }
-        iwm_reset(iwm);
-        ret = sdio_claim_irq(hw->func, iwm_sdio_isr);
-        if (ret) {
-                IWM_ERR(iwm, "Failed to claim irq: %d\n", ret);
-                goto release_host;
-        }
-        sdio_writeb(hw->func, 1, IWM_SDIO_INTR_ENABLE_ADDR, &ret);
-        if (ret < 0) {
-                IWM_ERR(iwm, "Couldn't enable INTR: %d\n", ret);
-                goto release_irq;
-        }
-        sdio_release_host(hw->func);
-        IWM_DBG_SDIO(iwm, INFO, "IWM SDIO enable\n");
-        return 0;
- release_irq:
-        sdio_release_irq(hw->func);
- release_host:
-        sdio_release_host(hw->func);
-        return ret;
-}
-static int if_sdio_disable(struct iwm_priv *iwm)
-{
-        struct iwm_sdio_priv *hw = iwm_to_if_sdio(iwm);
-        int ret;
-        sdio_claim_host(hw->func);
-        sdio_writeb(hw->func, 0, IWM_SDIO_INTR_ENABLE_ADDR, &ret);
-        if (ret < 0)
-                IWM_WARN(iwm, "Couldn't disable INTR: %d\n", ret);
-        sdio_release_irq(hw->func);
-        sdio_disable_func(hw->func);
-        sdio_release_host(hw->func);
-        iwm_sdio_rx_free(hw);
-        iwm_reset(iwm);
-        IWM_DBG_SDIO(iwm, INFO, "IWM SDIO disable\n");
-        return 0;
-}
-static int if_sdio_send_chunk(struct iwm_priv *iwm, u8 *buf, int count)
-{
-        struct iwm_sdio_priv *hw = iwm_to_if_sdio(iwm);
-        int aligned_count = ALIGN(count, hw->blk_size);
-        int ret;
-        if ((unsigned long)buf & 0x3) {
-                IWM_ERR(iwm, "buf <%p> is not dword aligned\n", buf);
-                /* TODO: Is this a hardware limitation? use get_unligned */
-                return -EINVAL;
-        }
-        sdio_claim_host(hw->func);
-        ret = sdio_memcpy_toio(hw->func, IWM_SDIO_DATA_ADDR, buf,
-                               aligned_count);
-        sdio_release_host(hw->func);
-        return ret;
-}
-static ssize_t iwm_debugfs_sdio_read(struct file *filp, char __user *buffer,
-                                     size_t count, loff_t *ppos)
-{
-        struct iwm_priv *iwm = filp->private_data;
-        struct iwm_sdio_priv *hw = iwm_to_if_sdio(iwm);
-        char *buf;
-        u8 cccr;
-        int buf_len = 4096, ret;
-        size_t len = 0;
-        if (*ppos != 0)
-                return 0;
-        if (count < sizeof(buf))
-                return -ENOSPC;
-        buf = kzalloc(buf_len, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-        sdio_claim_host(hw->func);
-        cccr =  sdio_f0_readb(hw->func, SDIO_CCCR_IOEx, &ret);
-        if (ret) {
-                IWM_ERR(iwm, "Could not read SDIO_CCCR_IOEx\n");
-                goto err;
-        }
-        len += snprintf(buf + len, buf_len - len, "CCCR_IOEx:  0x%x\n", cccr);
-        cccr =  sdio_f0_readb(hw->func, SDIO_CCCR_IORx, &ret);
-        if (ret) {
-                IWM_ERR(iwm, "Could not read SDIO_CCCR_IORx\n");
-                goto err;
-        }
-        len += snprintf(buf + len, buf_len - len, "CCCR_IORx:  0x%x\n", cccr);
-        cccr =  sdio_f0_readb(hw->func, SDIO_CCCR_IENx, &ret);
-        if (ret) {
-                IWM_ERR(iwm, "Could not read SDIO_CCCR_IENx\n");
-                goto err;
-        }
-        len += snprintf(buf + len, buf_len - len, "CCCR_IENx:  0x%x\n", cccr);
-        cccr =  sdio_f0_readb(hw->func, SDIO_CCCR_INTx, &ret);
-        if (ret) {
-                IWM_ERR(iwm, "Could not read SDIO_CCCR_INTx\n");
-                goto err;
-        }
-        len += snprintf(buf + len, buf_len - len, "CCCR_INTx:  0x%x\n", cccr);
-        cccr =  sdio_f0_readb(hw->func, SDIO_CCCR_ABORT, &ret);
-        if (ret) {
-                IWM_ERR(iwm, "Could not read SDIO_CCCR_ABORTx\n");
-                goto err;
-        }
-        len += snprintf(buf + len, buf_len - len, "CCCR_ABORT: 0x%x\n", cccr);
-        cccr =  sdio_f0_readb(hw->func, SDIO_CCCR_IF, &ret);
-        if (ret) {
-                IWM_ERR(iwm, "Could not read SDIO_CCCR_IF\n");
-                goto err;
-        }
-        len += snprintf(buf + len, buf_len - len, "CCCR_IF:    0x%x\n", cccr);
-        cccr =  sdio_f0_readb(hw->func, SDIO_CCCR_CAPS, &ret);
-        if (ret) {
-                IWM_ERR(iwm, "Could not read SDIO_CCCR_CAPS\n");
-                goto err;
-        }
-        len += snprintf(buf + len, buf_len - len, "CCCR_CAPS:  0x%x\n", cccr);
-        cccr =  sdio_f0_readb(hw->func, SDIO_CCCR_CIS, &ret);
-        if (ret) {
-                IWM_ERR(iwm, "Could not read SDIO_CCCR_CIS\n");
-                goto err;
-        }
-        len += snprintf(buf + len, buf_len - len, "CCCR_CIS:   0x%x\n", cccr);
-        ret = simple_read_from_buffer(buffer, len, ppos, buf, buf_len);
-err:
-        sdio_release_host(hw->func);
-        kfree(buf);
-        return ret;
-}
-static const struct file_operations iwm_debugfs_sdio_fops = {
-        .owner =        THIS_MODULE,
-        .open =         simple_open,
-        .read =         iwm_debugfs_sdio_read,
-        .llseek =       default_llseek,
-};
-static void if_sdio_debugfs_init(struct iwm_priv *iwm, struct dentry *parent_dir)
-{
-        struct iwm_sdio_priv *hw = iwm_to_if_sdio(iwm);
-        hw->cccr_dentry = debugfs_create_file("cccr", 0200,
-                                              parent_dir, iwm,
-                                              &iwm_debugfs_sdio_fops);
-}
-static void if_sdio_debugfs_exit(struct iwm_priv *iwm)
-{
-        struct iwm_sdio_priv *hw = iwm_to_if_sdio(iwm);
-        debugfs_remove(hw->cccr_dentry);
-}
-static struct iwm_if_ops if_sdio_ops = {
-        .enable = if_sdio_enable,
-        .disable = if_sdio_disable,
-        .send_chunk = if_sdio_send_chunk,
-        .debugfs_init = if_sdio_debugfs_init,
-        .debugfs_exit = if_sdio_debugfs_exit,
-        .umac_name = "iwmc3200wifi-umac-sdio.bin",
-        .calib_lmac_name = "iwmc3200wifi-calib-sdio.bin",
-        .lmac_name = "iwmc3200wifi-lmac-sdio.bin",
-};
-MODULE_FIRMWARE("iwmc3200wifi-umac-sdio.bin");
-MODULE_FIRMWARE("iwmc3200wifi-calib-sdio.bin");
-MODULE_FIRMWARE("iwmc3200wifi-lmac-sdio.bin");
-static int iwm_sdio_probe(struct sdio_func *func,
-                          const struct sdio_device_id *id)
-{
-        struct iwm_priv *iwm;
-        struct iwm_sdio_priv *hw;
-        struct device *dev = &func->dev;
-        int ret;
-        /* check if TOP has already initialized the card */
-        sdio_claim_host(func);
-        ret = sdio_enable_func(func);
-        if (ret) {
-                dev_err(dev, "wait for TOP to enable the device\n");
-                sdio_release_host(func);
-                return ret;
-        }
-        ret = sdio_set_block_size(func, IWM_SDIO_BLK_SIZE);
-        sdio_disable_func(func);
-        sdio_release_host(func);
-        if (ret < 0) {
-                dev_err(dev, "Failed to set block size: %d\n", ret);
-                return ret;
-        }
-        iwm = iwm_if_alloc(sizeof(struct iwm_sdio_priv), dev, &if_sdio_ops);
-        if (IS_ERR(iwm)) {
-                dev_err(dev, "allocate SDIO interface failed\n");
-                return PTR_ERR(iwm);
-        }
-        hw = iwm_private(iwm);
-        hw->iwm = iwm;
-        iwm_debugfs_init(iwm);
-        sdio_set_drvdata(func, hw);
-        hw->func = func;
-        hw->blk_size = IWM_SDIO_BLK_SIZE;
-        hw->isr_wq = create_singlethread_workqueue(KBUILD_MODNAME "_sdio");
-        if (!hw->isr_wq) {
-                ret = -ENOMEM;
-                goto debugfs_exit;
-        }
-        INIT_WORK(&hw->isr_worker, iwm_sdio_isr_worker);
-        ret = iwm_if_add(iwm);
-        if (ret) {
-                dev_err(dev, "add SDIO interface failed\n");
-                goto destroy_wq;
-        }
-        dev_info(dev, "IWM SDIO probe\n");
-        return 0;
- destroy_wq:
-        destroy_workqueue(hw->isr_wq);
- debugfs_exit:
-        iwm_debugfs_exit(iwm);
-        iwm_if_free(iwm);
-        return ret;
-}
-static void iwm_sdio_remove(struct sdio_func *func)
-{
-        struct iwm_sdio_priv *hw = sdio_get_drvdata(func);
-        struct iwm_priv *iwm = hw_to_iwm(hw);
-        struct device *dev = &func->dev;
-        iwm_if_remove(iwm);
-        destroy_workqueue(hw->isr_wq);
-        iwm_debugfs_exit(iwm);
-        iwm_if_free(iwm);
-        sdio_set_drvdata(func, NULL);
-        dev_info(dev, "IWM SDIO remove\n");
-}
-static const struct sdio_device_id iwm_sdio_ids[] = {
-        /* Global/AGN SKU */
-        { SDIO_DEVICE(SDIO_VENDOR_ID_INTEL, 0x1403) },
-        /* BGN SKU */
-        { SDIO_DEVICE(SDIO_VENDOR_ID_INTEL, 0x1408) },
-        { /* end: all zeroes */ },
-};
-MODULE_DEVICE_TABLE(sdio, iwm_sdio_ids);
-static struct sdio_driver iwm_sdio_driver = {
-        .name           = "iwm_sdio",
-        .id_table       = iwm_sdio_ids,
-        .probe          = iwm_sdio_probe,
-        .remove         = iwm_sdio_remove,
-};
-static int __init iwm_sdio_init_module(void)
-{
-        return sdio_register_driver(&iwm_sdio_driver);
-}
-static void __exit iwm_sdio_exit_module(void)
-{
-        sdio_unregister_driver(&iwm_sdio_driver);
-}
-module_init(iwm_sdio_init_module);
-module_exit(iwm_sdio_exit_module);
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR(IWM_COPYRIGHT " " IWM_AUTHOR);
diff --git a/drivers/net/wireless/iwmc3200wifi/sdio.h b/drivers/net/wireless/iwmc3200wifi/sdio.h
deleted file mode 100644
index aab6b6892e45..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/sdio.h
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- */
-#ifndef __IWM_SDIO_H__
-#define __IWM_SDIO_H__
-#define IWM_SDIO_DATA_ADDR           0x0
-#define IWM_SDIO_INTR_ENABLE_ADDR    0x14
-#define IWM_SDIO_INTR_STATUS_ADDR    0x13
-#define IWM_SDIO_INTR_CLEAR_ADDR     0x13
-#define IWM_SDIO_INTR_GET_SIZE_ADDR  0x2C
-#define IWM_SDIO_BLK_SIZE       256
-#define iwm_to_if_sdio(i) (struct iwm_sdio_priv *)(iwm->private)
-struct iwm_sdio_priv {
-        struct sdio_func *func;
-        struct iwm_priv *iwm;
-        struct workqueue_struct *isr_wq;
-        struct work_struct isr_worker;
-        struct dentry *cccr_dentry;
-        unsigned int blk_size;
-};
-#endif
diff --git a/drivers/net/wireless/iwmc3200wifi/trace.c b/drivers/net/wireless/iwmc3200wifi/trace.c
deleted file mode 100644
index 904d36f22311..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/trace.c
+++ /dev/null
@@ -1,3 +0,0 @@
-#include "iwm.h"
-#define CREATE_TRACE_POINTS
-#include "trace.h"
diff --git a/drivers/net/wireless/iwmc3200wifi/trace.h b/drivers/net/wireless/iwmc3200wifi/trace.h
deleted file mode 100644
index f5f7070b7e22..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/trace.h
+++ /dev/null
@@ -1,283 +0,0 @@
-#if !defined(__IWM_TRACE_H__) || defined(TRACE_HEADER_MULTI_READ)
-#define __IWM_TRACE_H__
-#include <linux/tracepoint.h>
-#if !defined(CONFIG_IWM_TRACING)
-#undef TRACE_EVENT
-#define TRACE_EVENT(name, proto, ...) \
-static inline void trace_ ## name(proto) {}
-#endif
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM iwm
-#define IWM_ENTRY       __array(char, ndev_name, 16)
-#define IWM_ASSIGN      strlcpy(__entry->ndev_name, iwm_to_ndev(iwm)->name, 16)
-#define IWM_PR_FMT      "%s"
-#define IWM_PR_ARG      __entry->ndev_name
-TRACE_EVENT(iwm_tx_nonwifi_cmd,
-        TP_PROTO(struct iwm_priv *iwm, struct iwm_udma_out_nonwifi_hdr *hdr),
-        TP_ARGS(iwm, hdr),
-        TP_STRUCT__entry(
-                IWM_ENTRY
-                __field(u8, opcode)
-                __field(u8, resp)
-                __field(u8, eot)
-                __field(u8, hw)
-                __field(u16, seq)
-                __field(u32, addr)
-                __field(u32, op1)
-                __field(u32, op2)
-        ),
-        TP_fast_assign(
-                IWM_ASSIGN;
-                __entry->opcode = GET_VAL32(hdr->cmd, UMAC_HDI_OUT_CMD_OPCODE);
-                __entry->resp = GET_VAL32(hdr->cmd, UDMA_HDI_OUT_NW_CMD_RESP);
-                __entry->eot = GET_VAL32(hdr->cmd, UMAC_HDI_OUT_CMD_EOT);
-                __entry->hw = GET_VAL32(hdr->cmd, UDMA_HDI_OUT_NW_CMD_HANDLE_BY_HW);
-                __entry->seq = GET_VAL32(hdr->cmd, UDMA_HDI_OUT_CMD_NON_WIFI_HW_SEQ_NUM);
-                __entry->addr = le32_to_cpu(hdr->addr);
-                __entry->op1 = le32_to_cpu(hdr->op1_sz);
-                __entry->op2 = le32_to_cpu(hdr->op2);
-        ),
-        TP_printk(
-                IWM_PR_FMT " Tx TARGET CMD: opcode 0x%x, resp %d, eot %d, "
-                "hw %d, seq 0x%x, addr 0x%x, op1 0x%x, op2 0x%x",
-                IWM_PR_ARG, __entry->opcode, __entry->resp, __entry->eot,
-                __entry->hw, __entry->seq, __entry->addr, __entry->op1,
-                __entry->op2
-        )
-);
-TRACE_EVENT(iwm_tx_wifi_cmd,
-        TP_PROTO(struct iwm_priv *iwm, struct iwm_umac_wifi_out_hdr *hdr),
-        TP_ARGS(iwm, hdr),
-        TP_STRUCT__entry(
-                IWM_ENTRY
-                __field(u8, opcode)
-                __field(u8, lmac)
-                __field(u8, resp)
-                __field(u8, eot)
-                __field(u8, ra_tid)
-                __field(u8, credit_group)
-                __field(u8, color)
-                __field(u16, seq)
-        ),
-        TP_fast_assign(
-                IWM_ASSIGN;
-                __entry->opcode = hdr->sw_hdr.cmd.cmd;
-                __entry->lmac = 0;
-                __entry->seq = __le16_to_cpu(hdr->sw_hdr.cmd.seq_num);
-                __entry->resp = GET_VAL8(hdr->sw_hdr.cmd.flags, UMAC_DEV_CMD_FLAGS_RESP_REQ);
-                __entry->color = GET_VAL32(hdr->sw_hdr.meta_data, UMAC_FW_CMD_TX_STA_COLOR);
-                __entry->eot = GET_VAL32(hdr->hw_hdr.cmd, UMAC_HDI_OUT_CMD_EOT);
-                __entry->ra_tid = GET_VAL32(hdr->hw_hdr.meta_data, UMAC_HDI_OUT_RATID);
-                __entry->credit_group = GET_VAL32(hdr->hw_hdr.meta_data, UMAC_HDI_OUT_CREDIT_GRP);
-                if (__entry->opcode == UMAC_CMD_OPCODE_WIFI_PASS_THROUGH ||
-                    __entry->opcode == UMAC_CMD_OPCODE_WIFI_IF_WRAPPER) {
-                        __entry->lmac = 1;
-                        __entry->opcode = ((struct iwm_lmac_hdr *)(hdr + 1))->id;
-                }
-        ),
-        TP_printk(
-                IWM_PR_FMT " Tx %cMAC CMD: opcode 0x%x, resp %d, eot %d, "
-                "seq 0x%x, sta_color 0x%x, ra_tid 0x%x, credit_group 0x%x",
-                IWM_PR_ARG, __entry->lmac ? 'L' : 'U', __entry->opcode,
-                __entry->resp, __entry->eot, __entry->seq, __entry->color,
-                __entry->ra_tid, __entry->credit_group
-        )
-);
-TRACE_EVENT(iwm_tx_packets,
-        TP_PROTO(struct iwm_priv *iwm, u8 *buf, int len),
-        TP_ARGS(iwm, buf, len),
-        TP_STRUCT__entry(
-                IWM_ENTRY
-                __field(u8, eot)
-                __field(u8, ra_tid)
-                __field(u8, credit_group)
-                __field(u8, color)
-                __field(u16, seq)
-                __field(u8, npkt)
-                __field(u32, bytes)
-        ),
-        TP_fast_assign(
-                struct iwm_umac_wifi_out_hdr *hdr =
-                        (struct iwm_umac_wifi_out_hdr *)buf;
-                IWM_ASSIGN;
-                __entry->eot = GET_VAL32(hdr->hw_hdr.cmd, UMAC_HDI_OUT_CMD_EOT);
-                __entry->ra_tid = GET_VAL32(hdr->hw_hdr.meta_data, UMAC_HDI_OUT_RATID);
-                __entry->credit_group = GET_VAL32(hdr->hw_hdr.meta_data, UMAC_HDI_OUT_CREDIT_GRP);
-                __entry->color = GET_VAL32(hdr->sw_hdr.meta_data, UMAC_FW_CMD_TX_STA_COLOR);
-                __entry->seq = __le16_to_cpu(hdr->sw_hdr.cmd.seq_num);
-                __entry->npkt = 1;
-                __entry->bytes = len;
-                if (!__entry->eot) {
-                        int count;
-                        u8 *ptr = buf;
-                        __entry->npkt = 0;
-                        while (ptr < buf + len) {
-                                count = GET_VAL32(hdr->sw_hdr.meta_data,
-                                                  UMAC_FW_CMD_BYTE_COUNT);
-                                ptr += ALIGN(sizeof(*hdr) + count, 16);
-                                hdr = (struct iwm_umac_wifi_out_hdr *)ptr;
-                                __entry->npkt++;
-                        }
-                }
-        ),
-        TP_printk(
-                IWM_PR_FMT " Tx %spacket: eot %d, seq 0x%x, sta_color 0x%x, "
-                "ra_tid 0x%x, credit_group 0x%x, embedded_packets %d, %d bytes",
-                IWM_PR_ARG, !__entry->eot ? "concatenated " : "",
-                __entry->eot, __entry->seq, __entry->color, __entry->ra_tid,
-                __entry->credit_group, __entry->npkt, __entry->bytes
-        )
-);
-TRACE_EVENT(iwm_rx_nonwifi_cmd,
-        TP_PROTO(struct iwm_priv *iwm, void *buf, int len),
-        TP_ARGS(iwm, buf, len),
-        TP_STRUCT__entry(
-                IWM_ENTRY
-                __field(u8, opcode)
-                __field(u16, seq)
-                __field(u32, len)
-        ),
-        TP_fast_assign(
-                struct iwm_udma_in_hdr *hdr = buf;
-                IWM_ASSIGN;
-                __entry->opcode = GET_VAL32(hdr->cmd, UDMA_HDI_IN_NW_CMD_OPCODE);
-                __entry->seq = GET_VAL32(hdr->cmd, UDMA_HDI_IN_CMD_NON_WIFI_HW_SEQ_NUM);
-                __entry->len = len;
-        ),
-        TP_printk(
-                IWM_PR_FMT " Rx TARGET RESP: opcode 0x%x, seq 0x%x, len 0x%x",
-                IWM_PR_ARG, __entry->opcode, __entry->seq, __entry->len
-        )
-);
-TRACE_EVENT(iwm_rx_wifi_cmd,
-        TP_PROTO(struct iwm_priv *iwm, struct iwm_umac_wifi_in_hdr *hdr),
-        TP_ARGS(iwm, hdr),
-        TP_STRUCT__entry(
-                IWM_ENTRY
-                __field(u8, cmd)
-                __field(u8, source)
-                __field(u16, seq)
-                __field(u32, count)
-        ),
-        TP_fast_assign(
-                IWM_ASSIGN;
-                __entry->cmd = hdr->sw_hdr.cmd.cmd;
-                __entry->source = GET_VAL32(hdr->hw_hdr.cmd, UMAC_HDI_IN_CMD_SOURCE);
-                __entry->count = GET_VAL32(hdr->sw_hdr.meta_data, UMAC_FW_CMD_BYTE_COUNT);
-                __entry->seq = le16_to_cpu(hdr->sw_hdr.cmd.seq_num);
-        ),
-        TP_printk(
-                IWM_PR_FMT " Rx %s RESP: cmd 0x%x, seq 0x%x, count 0x%x",
-                IWM_PR_ARG, __entry->source == UMAC_HDI_IN_SOURCE_FHRX ? "LMAC" :
-                __entry->source == UMAC_HDI_IN_SOURCE_FW ? "UMAC" : "UDMA",
-                __entry->cmd, __entry->seq, __entry->count
-        )
-);
-#define iwm_ticket_action_symbol                \
-        { IWM_RX_TICKET_DROP, "DROP" },         \
-        { IWM_RX_TICKET_RELEASE, "RELEASE" },   \
-        { IWM_RX_TICKET_SNIFFER, "SNIFFER" },   \
-        { IWM_RX_TICKET_ENQUEUE, "ENQUEUE" }
-TRACE_EVENT(iwm_rx_ticket,
-        TP_PROTO(struct iwm_priv *iwm, void *buf, int len),
-        TP_ARGS(iwm, buf, len),
-        TP_STRUCT__entry(
-                IWM_ENTRY
-                __field(u8, action)
-                __field(u8, reason)
-                __field(u16, id)
-                __field(u16, flags)
-        ),
-        TP_fast_assign(
-                struct iwm_rx_ticket *ticket =
-                        ((struct iwm_umac_notif_rx_ticket *)buf)->tickets;
-                IWM_ASSIGN;
-                __entry->id = le16_to_cpu(ticket->id);
-                __entry->action = le16_to_cpu(ticket->action);
-                __entry->flags = le16_to_cpu(ticket->flags);
-                __entry->reason = (__entry->flags & IWM_RX_TICKET_DROP_REASON_MSK) >> IWM_RX_TICKET_DROP_REASON_POS;
-        ),
-        TP_printk(
-                IWM_PR_FMT " Rx ticket: id 0x%x, action %s, %s 0x%x%s",
-                IWM_PR_ARG, __entry->id,
-                __print_symbolic(__entry->action, iwm_ticket_action_symbol),
-                __entry->reason ? "reason" : "flags",
-                __entry->reason ? __entry->reason : __entry->flags,
-                __entry->flags & IWM_RX_TICKET_AMSDU_MSK ? ", AMSDU frame" : ""
-        )
-);
-TRACE_EVENT(iwm_rx_packet,
-        TP_PROTO(struct iwm_priv *iwm, void *buf, int len),
-        TP_ARGS(iwm, buf, len),
-        TP_STRUCT__entry(
-                IWM_ENTRY
-                __field(u8, source)
-                __field(u16, id)
-                __field(u32, len)
-        ),
-        TP_fast_assign(
-                struct iwm_umac_wifi_in_hdr *hdr = buf;
-                IWM_ASSIGN;
-                __entry->source = GET_VAL32(hdr->hw_hdr.cmd, UMAC_HDI_IN_CMD_SOURCE);
-                __entry->id = le16_to_cpu(hdr->sw_hdr.cmd.seq_num);
-                __entry->len = len - sizeof(*hdr);
-        ),
-        TP_printk(
-                IWM_PR_FMT " Rx %s packet: id 0x%x, %d bytes",
-                IWM_PR_ARG, __entry->source == UMAC_HDI_IN_SOURCE_FHRX ?
-                "LMAC" : "UMAC", __entry->id, __entry->len
-        )
-);
-#endif
-#undef TRACE_INCLUDE_PATH
-#define TRACE_INCLUDE_PATH .
-#undef TRACE_INCLUDE_FILE
-#define TRACE_INCLUDE_FILE trace
-#include <trace/define_trace.h>
diff --git a/drivers/net/wireless/iwmc3200wifi/tx.c b/drivers/net/wireless/iwmc3200wifi/tx.c
deleted file mode 100644
index be98074c0608..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/tx.c
+++ /dev/null
@@ -1,529 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- */
-/*
- * iwm Tx theory of operation:
- *
- * 1) We receive a 802.3 frame from the stack
- * 2) We convert it to a 802.11 frame [iwm_xmit_frame]
- * 3) We queue it to its corresponding tx queue [iwm_xmit_frame]
- * 4) We schedule the tx worker. There is one worker per tx
- *    queue. [iwm_xmit_frame]
- * 5) The tx worker is scheduled
- * 6) We go through every queued skb on the tx queue, and for each
- *    and every one of them: [iwm_tx_worker]
- *    a) We check if we have enough Tx credits (see below for a Tx
- *       credits description) for the frame length. [iwm_tx_worker]
- *    b) If we do, we aggregate the Tx frame into a UDMA one, by
- *       concatenating one REPLY_TX command per Tx frame. [iwm_tx_worker]
- *    c) When we run out of credits, or when we reach the maximum
- *       concatenation size, we actually send the concatenated UDMA
- *       frame. [iwm_tx_worker]
- *
- * When we run out of Tx credits, the skbs are filling the tx queue,
- * and eventually we will stop the netdev queue. [iwm_tx_worker]
- * The tx queue is emptied as we're getting new tx credits, by
- * scheduling the tx_worker. [iwm_tx_credit_inc]
- * The netdev queue is started again when we have enough tx credits,
- * and when our tx queue has some reasonable amout of space available
- * (i.e. half of the max size). [iwm_tx_worker]
- */
-#include <linux/slab.h>
-#include <linux/skbuff.h>
-#include <linux/netdevice.h>
-#include <linux/ieee80211.h>
-#include "iwm.h"
-#include "debug.h"
-#include "commands.h"
-#include "hal.h"
-#include "umac.h"
-#include "bus.h"
-#define IWM_UMAC_PAGE_ALLOC_WRAP 0xffff
-#define BYTES_TO_PAGES(n)        (1 + ((n) >> ilog2(IWM_UMAC_PAGE_SIZE)) - \
-                                 (((n) & (IWM_UMAC_PAGE_SIZE - 1)) == 0))
-#define pool_id_to_queue(id)     ((id < IWM_TX_CMD_QUEUE) ? id : id - 1)
-#define queue_to_pool_id(q)      ((q < IWM_TX_CMD_QUEUE) ? q : q + 1)
-/* require to hold tx_credit lock */
-static int iwm_tx_credit_get(struct iwm_tx_credit *tx_credit, int id)
-{
-        struct pool_entry *pool = &tx_credit->pools[id];
-        struct spool_entry *spool = &tx_credit->spools[pool->sid];
-        int spool_pages;
-        /* number of pages can be taken from spool by this pool */
-        spool_pages = spool->max_pages - spool->alloc_pages +
-                      max(pool->min_pages - pool->alloc_pages, 0);
-        return min(pool->max_pages - pool->alloc_pages, spool_pages);
-}
-static bool iwm_tx_credit_ok(struct iwm_priv *iwm, int id, int nb)
-{
-        u32 npages = BYTES_TO_PAGES(nb);
-        if (npages <= iwm_tx_credit_get(&iwm->tx_credit, id))
-                return 1;
-        set_bit(id, &iwm->tx_credit.full_pools_map);
-        IWM_DBG_TX(iwm, DBG, "LINK: stop txq[%d], available credit: %d\n",
-                   pool_id_to_queue(id),
-                   iwm_tx_credit_get(&iwm->tx_credit, id));
-        return 0;
-}
-void iwm_tx_credit_inc(struct iwm_priv *iwm, int id, int total_freed_pages)
-{
-        struct pool_entry *pool;
-        struct spool_entry *spool;
-        int freed_pages;
-        int queue;
-        BUG_ON(id >= IWM_MACS_OUT_GROUPS);
-        pool = &iwm->tx_credit.pools[id];
-        spool = &iwm->tx_credit.spools[pool->sid];
-        freed_pages = total_freed_pages - pool->total_freed_pages;
-        IWM_DBG_TX(iwm, DBG, "Free %d pages for pool[%d]\n", freed_pages, id);
-        if (!freed_pages) {
-                IWM_DBG_TX(iwm, DBG, "No pages are freed by UMAC\n");
-                return;
-        } else if (freed_pages < 0)
-                freed_pages += IWM_UMAC_PAGE_ALLOC_WRAP + 1;
-        if (pool->alloc_pages > pool->min_pages) {
-                int spool_pages = pool->alloc_pages - pool->min_pages;
-                spool_pages = min(spool_pages, freed_pages);
-                spool->alloc_pages -= spool_pages;
-        }
-        pool->alloc_pages -= freed_pages;
-        pool->total_freed_pages = total_freed_pages;
-        IWM_DBG_TX(iwm, DBG, "Pool[%d] pages alloc: %d, total_freed: %d, "
-                   "Spool[%d] pages alloc: %d\n", id, pool->alloc_pages,
-                   pool->total_freed_pages, pool->sid, spool->alloc_pages);
-        if (test_bit(id, &iwm->tx_credit.full_pools_map) &&
-            (pool->alloc_pages < pool->max_pages / 2)) {
-                clear_bit(id, &iwm->tx_credit.full_pools_map);
-                queue = pool_id_to_queue(id);
-                IWM_DBG_TX(iwm, DBG, "LINK: start txq[%d], available "
-                           "credit: %d\n", queue,
-                           iwm_tx_credit_get(&iwm->tx_credit, id));
-                queue_work(iwm->txq[queue].wq, &iwm->txq[queue].worker);
-        }
-}
-static void iwm_tx_credit_dec(struct iwm_priv *iwm, int id, int alloc_pages)
-{
-        struct pool_entry *pool;
-        struct spool_entry *spool;
-        int spool_pages;
-        IWM_DBG_TX(iwm, DBG, "Allocate %d pages for pool[%d]\n",
-                   alloc_pages, id);
-        BUG_ON(id >= IWM_MACS_OUT_GROUPS);
-        pool = &iwm->tx_credit.pools[id];
-        spool = &iwm->tx_credit.spools[pool->sid];
-        spool_pages = pool->alloc_pages + alloc_pages - pool->min_pages;
-        if (pool->alloc_pages >= pool->min_pages)
-                spool->alloc_pages += alloc_pages;
-        else if (spool_pages > 0)
-                spool->alloc_pages += spool_pages;
-        pool->alloc_pages += alloc_pages;
-        IWM_DBG_TX(iwm, DBG, "Pool[%d] pages alloc: %d, total_freed: %d, "
-                   "Spool[%d] pages alloc: %d\n", id, pool->alloc_pages,
-                   pool->total_freed_pages, pool->sid, spool->alloc_pages);
-}
-int iwm_tx_credit_alloc(struct iwm_priv *iwm, int id, int nb)
-{
-        u32 npages = BYTES_TO_PAGES(nb);
-        int ret = 0;
-        spin_lock(&iwm->tx_credit.lock);
-        if (!iwm_tx_credit_ok(iwm, id, nb)) {
-                IWM_DBG_TX(iwm, DBG, "No credit available for pool[%d]\n", id);
-                ret = -ENOSPC;
-                goto out;
-        }
-        iwm_tx_credit_dec(iwm, id, npages);
- out:
-        spin_unlock(&iwm->tx_credit.lock);
-        return ret;
-}
-/*
- * Since we're on an SDIO or USB bus, we are not sharing memory
- * for storing to be transmitted frames. The host needs to push
- * them upstream. As a consequence there needs to be a way for
- * the target to let us know if it can actually take more TX frames
- * or not. This is what Tx credits are for.
- *
- * For each Tx HW queue, we have a Tx pool, and then we have one
- * unique super pool (spool), which is actually a global pool of
- * all the UMAC pages.
- * For each Tx pool we have a min_pages, a max_pages fields, and a
- * alloc_pages fields. The alloc_pages tracks the number of pages
- * currently allocated from the tx pool.
- * Here are the rules to check if given a tx frame we have enough
- * tx credits for it:
- * 1) We translate the frame length into a number of UMAC pages.
- *    Let's call them n_pages.
- * 2) For the corresponding tx pool, we check if n_pages +
- *    pool->alloc_pages is higher than pool->min_pages. min_pages
- *    represent a set of pre-allocated pages on the tx pool. If
- *    that's the case, then we need to allocate those pages from
- *    the spool. We can do so until we reach spool->max_pages.
- * 3) Each tx pool is not allowed to allocate more than pool->max_pages
- *    from the spool, so once we're over min_pages, we can allocate
- *    pages from the spool, but not more than max_pages.
- *
- * When the tx code path needs to send a tx frame, it checks first
- * if it has enough tx credits, following those rules. [iwm_tx_credit_get]
- * If it does, it then updates the pool and spool counters and
- * then send the frame. [iwm_tx_credit_alloc and iwm_tx_credit_dec]
- * On the other side, when the UMAC is done transmitting frames, it
- * will send a credit update notification to the host. This is when
- * the pool and spool counters gets to be decreased. [iwm_tx_credit_inc,
- * called from rx.c:iwm_ntf_tx_credit_update]
- *
- */
-void iwm_tx_credit_init_pools(struct iwm_priv *iwm,
-                              struct iwm_umac_notif_alive *alive)
-{
-        int i, sid, pool_pages;
-        spin_lock(&iwm->tx_credit.lock);
-        iwm->tx_credit.pool_nr = le16_to_cpu(alive->page_grp_count);
-        iwm->tx_credit.full_pools_map = 0;
-        memset(&iwm->tx_credit.spools[0], 0, sizeof(struct spool_entry));
-        IWM_DBG_TX(iwm, DBG, "Pools number is %d\n", iwm->tx_credit.pool_nr);
-        for (i = 0; i < iwm->tx_credit.pool_nr; i++) {
-                __le32 page_grp_state = alive->page_grp_state[i];
-                iwm->tx_credit.pools[i].id = GET_VAL32(page_grp_state,
-                                UMAC_ALIVE_PAGE_STS_GRP_NUM);
-                iwm->tx_credit.pools[i].sid = GET_VAL32(page_grp_state,
-                                UMAC_ALIVE_PAGE_STS_SGRP_NUM);
-                iwm->tx_credit.pools[i].min_pages = GET_VAL32(page_grp_state,
-                                UMAC_ALIVE_PAGE_STS_GRP_MIN_SIZE);
-                iwm->tx_credit.pools[i].max_pages = GET_VAL32(page_grp_state,
-                                UMAC_ALIVE_PAGE_STS_GRP_MAX_SIZE);
-                iwm->tx_credit.pools[i].alloc_pages = 0;
-                iwm->tx_credit.pools[i].total_freed_pages = 0;
-                sid = iwm->tx_credit.pools[i].sid;
-                pool_pages = iwm->tx_credit.pools[i].min_pages;
-                if (iwm->tx_credit.spools[sid].max_pages == 0) {
-                        iwm->tx_credit.spools[sid].id = sid;
-                        iwm->tx_credit.spools[sid].max_pages =
-                                GET_VAL32(page_grp_state,
-                                          UMAC_ALIVE_PAGE_STS_SGRP_MAX_SIZE);
-                        iwm->tx_credit.spools[sid].alloc_pages = 0;
-                }
-                iwm->tx_credit.spools[sid].alloc_pages += pool_pages;
-                IWM_DBG_TX(iwm, DBG, "Pool idx: %d, id: %d, sid: %d, capacity "
-                           "min: %d, max: %d, pool alloc: %d, total_free: %d, "
-                           "super poll alloc: %d\n",
-                           i, iwm->tx_credit.pools[i].id,
-                           iwm->tx_credit.pools[i].sid,
-                           iwm->tx_credit.pools[i].min_pages,
-                           iwm->tx_credit.pools[i].max_pages,
-                           iwm->tx_credit.pools[i].alloc_pages,
-                           iwm->tx_credit.pools[i].total_freed_pages,
-                           iwm->tx_credit.spools[sid].alloc_pages);
-        }
-        spin_unlock(&iwm->tx_credit.lock);
-}
-#define IWM_UDMA_HDR_LEN        sizeof(struct iwm_umac_wifi_out_hdr)
-static __le16 iwm_tx_build_packet(struct iwm_priv *iwm, struct sk_buff *skb,
-                                  int pool_id, u8 *buf)
-{
-        struct iwm_umac_wifi_out_hdr *hdr = (struct iwm_umac_wifi_out_hdr *)buf;
-        struct iwm_udma_wifi_cmd udma_cmd;
-        struct iwm_umac_cmd umac_cmd;
-        struct iwm_tx_info *tx_info = skb_to_tx_info(skb);
-        udma_cmd.count = cpu_to_le16(skb->len +
-                                     sizeof(struct iwm_umac_fw_cmd_hdr));
-        /* set EOP to 0 here. iwm_udma_wifi_hdr_set_eop() will be
-         * called later to set EOP for the last packet. */
-        udma_cmd.eop = 0;
-        udma_cmd.credit_group = pool_id;
-        udma_cmd.ra_tid = tx_info->sta << 4 | tx_info->tid;
-        udma_cmd.lmac_offset = 0;
-        umac_cmd.id = REPLY_TX;
-        umac_cmd.count = cpu_to_le16(skb->len);
-        umac_cmd.color = tx_info->color;
-        umac_cmd.resp = 0;
-        umac_cmd.seq_num = cpu_to_le16(iwm_alloc_wifi_cmd_seq(iwm));
-        iwm_build_udma_wifi_hdr(iwm, &hdr->hw_hdr, &udma_cmd);
-        iwm_build_umac_hdr(iwm, &hdr->sw_hdr, &umac_cmd);
-        memcpy(buf + sizeof(*hdr), skb->data, skb->len);
-        return umac_cmd.seq_num;
-}
-static int iwm_tx_send_concat_packets(struct iwm_priv *iwm,
-                                      struct iwm_tx_queue *txq)
-{
-        int ret;
-        if (!txq->concat_count)
-                return 0;
-        IWM_DBG_TX(iwm, DBG, "Send concatenated Tx: queue %d, %d bytes\n",
-                   txq->id, txq->concat_count);
-        /* mark EOP for the last packet */
-        iwm_udma_wifi_hdr_set_eop(iwm, txq->concat_ptr, 1);
-        trace_iwm_tx_packets(iwm, txq->concat_buf, txq->concat_count);
-        ret = iwm_bus_send_chunk(iwm, txq->concat_buf, txq->concat_count);
-        txq->concat_count = 0;
-        txq->concat_ptr = txq->concat_buf;
-        return ret;
-}
-void iwm_tx_worker(struct work_struct *work)
-{
-        struct iwm_priv *iwm;
-        struct iwm_tx_info *tx_info = NULL;
-        struct sk_buff *skb;
-        struct iwm_tx_queue *txq;
-        struct iwm_sta_info *sta_info;
-        struct iwm_tid_info *tid_info;
-        int cmdlen, ret, pool_id;
-        txq = container_of(work, struct iwm_tx_queue, worker);
-        iwm = container_of(txq, struct iwm_priv, txq[txq->id]);
-        pool_id = queue_to_pool_id(txq->id);
-        while (!test_bit(pool_id, &iwm->tx_credit.full_pools_map) &&
-               !skb_queue_empty(&txq->queue)) {
-                spin_lock_bh(&txq->lock);
-                skb = skb_dequeue(&txq->queue);
-                spin_unlock_bh(&txq->lock);
-                tx_info = skb_to_tx_info(skb);
-                sta_info = &iwm->sta_table[tx_info->sta];
-                if (!sta_info->valid) {
-                        IWM_ERR(iwm, "Trying to send a frame to unknown STA\n");
-                        kfree_skb(skb);
-                        continue;
-                }
-                tid_info = &sta_info->tid_info[tx_info->tid];
-                mutex_lock(&tid_info->mutex);
-                /*
-                 * If the RAxTID is stopped, we queue the skb to the stopped
-                 * queue.
-                 * Whenever we'll get a UMAC notification to resume the tx flow
-                 * for this RAxTID, we'll merge back the stopped queue into the
-                 * regular queue. See iwm_ntf_stop_resume_tx() from rx.c.
-                 */
-                if (tid_info->stopped) {
-                        IWM_DBG_TX(iwm, DBG, "%dx%d stopped\n",
-                                   tx_info->sta, tx_info->tid);
-                        spin_lock_bh(&txq->lock);
-                        skb_queue_tail(&txq->stopped_queue, skb);
-                        spin_unlock_bh(&txq->lock);
-                        mutex_unlock(&tid_info->mutex);
-                        continue;
-                }
-                cmdlen = IWM_UDMA_HDR_LEN + skb->len;
-                IWM_DBG_TX(iwm, DBG, "Tx frame on queue %d: skb: 0x%p, sta: "
-                           "%d, color: %d\n", txq->id, skb, tx_info->sta,
-                           tx_info->color);
-                if (txq->concat_count + cmdlen > IWM_HAL_CONCATENATE_BUF_SIZE)
-                        iwm_tx_send_concat_packets(iwm, txq);
-                ret = iwm_tx_credit_alloc(iwm, pool_id, cmdlen);
-                if (ret) {
-                        IWM_DBG_TX(iwm, DBG, "not enough tx_credit for queue "
-                                   "%d, Tx worker stopped\n", txq->id);
-                        spin_lock_bh(&txq->lock);
-                        skb_queue_head(&txq->queue, skb);
-                        spin_unlock_bh(&txq->lock);
-                        mutex_unlock(&tid_info->mutex);
-                        break;
-                }
-                txq->concat_ptr = txq->concat_buf + txq->concat_count;
-                tid_info->last_seq_num =
-                        iwm_tx_build_packet(iwm, skb, pool_id, txq->concat_ptr);
-                txq->concat_count += ALIGN(cmdlen, 16);
-                mutex_unlock(&tid_info->mutex);
-                kfree_skb(skb);
-        }
-        iwm_tx_send_concat_packets(iwm, txq);
-        if (__netif_subqueue_stopped(iwm_to_ndev(iwm), txq->id) &&
-            !test_bit(pool_id, &iwm->tx_credit.full_pools_map) &&
-            (skb_queue_len(&txq->queue) < IWM_TX_LIST_SIZE / 2)) {
-                IWM_DBG_TX(iwm, DBG, "LINK: start netif_subqueue[%d]", txq->id);
-                netif_wake_subqueue(iwm_to_ndev(iwm), txq->id);
-        }
-}
-int iwm_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
-{
-        struct iwm_priv *iwm = ndev_to_iwm(netdev);
-        struct wireless_dev *wdev = iwm_to_wdev(iwm);
-        struct iwm_tx_info *tx_info;
-        struct iwm_tx_queue *txq;
-        struct iwm_sta_info *sta_info;
-        u8 *dst_addr, sta_id;
-        u16 queue;
-        int ret;
-        if (!test_bit(IWM_STATUS_ASSOCIATED, &iwm->status)) {
-                IWM_DBG_TX(iwm, DBG, "LINK: stop netif_all_queues: "
-                           "not associated\n");
-                netif_tx_stop_all_queues(netdev);
-                goto drop;
-        }
-        queue = skb_get_queue_mapping(skb);
-        BUG_ON(queue >= IWM_TX_DATA_QUEUES); /* no iPAN yet */
-        txq = &iwm->txq[queue];
-        /* No free space for Tx, tx_worker is too slow */
-        if ((skb_queue_len(&txq->queue) > IWM_TX_LIST_SIZE) ||
-            (skb_queue_len(&txq->stopped_queue) > IWM_TX_LIST_SIZE)) {
-                IWM_DBG_TX(iwm, DBG, "LINK: stop netif_subqueue[%d]\n", queue);
-                netif_stop_subqueue(netdev, queue);
-                return NETDEV_TX_BUSY;
-        }
-        ret = ieee80211_data_from_8023(skb, netdev->dev_addr, wdev->iftype,
-                                       iwm->bssid, 0);
-        if (ret) {
-                IWM_ERR(iwm, "build wifi header failed\n");
-                goto drop;
-        }
-        dst_addr = ((struct ieee80211_hdr *)(skb->data))->addr1;
-        for (sta_id = 0; sta_id < IWM_STA_TABLE_NUM; sta_id++) {
-                sta_info = &iwm->sta_table[sta_id];
-                if (sta_info->valid &&
-                    !memcmp(dst_addr, sta_info->addr, ETH_ALEN))
-                        break;
-        }
-        if (sta_id == IWM_STA_TABLE_NUM) {
-                IWM_ERR(iwm, "STA %pM not found in sta_table, Tx ignored\n",
-                        dst_addr);
-                goto drop;
-        }
-        tx_info = skb_to_tx_info(skb);
-        tx_info->sta = sta_id;
-        tx_info->color = sta_info->color;
-        /* UMAC uses TID 8 (vs. 0) for non QoS packets */
-        if (sta_info->qos)
-                tx_info->tid = skb->priority;
-        else
-                tx_info->tid = IWM_UMAC_MGMT_TID;
-        spin_lock_bh(&iwm->txq[queue].lock);
-        skb_queue_tail(&iwm->txq[queue].queue, skb);
-        spin_unlock_bh(&iwm->txq[queue].lock);
-        queue_work(iwm->txq[queue].wq, &iwm->txq[queue].worker);
-        netdev->stats.tx_packets++;
-        netdev->stats.tx_bytes += skb->len;
-        return NETDEV_TX_OK;
- drop:
-        netdev->stats.tx_dropped++;
-        dev_kfree_skb_any(skb);
-        return NETDEV_TX_OK;
-}
diff --git a/drivers/net/wireless/iwmc3200wifi/umac.h b/drivers/net/wireless/iwmc3200wifi/umac.h
deleted file mode 100644
index 4a137d334a42..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/umac.h
+++ /dev/null
@@ -1,789 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in
- *     the documentation and/or other materials provided with the
- *     distribution.
- *   * Neither the name of Intel Corporation nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- */
-#ifndef __IWM_UMAC_H__
-#define __IWM_UMAC_H__
-struct iwm_udma_in_hdr {
-        __le32 cmd;
-        __le32 size;
-} __packed;
-struct iwm_udma_out_nonwifi_hdr {
-        __le32 cmd;
-        __le32 addr;
-        __le32 op1_sz;
-        __le32 op2;
-} __packed;
-struct iwm_udma_out_wifi_hdr {
-        __le32 cmd;
-        __le32 meta_data;
-} __packed;
-/* Sequence numbering */
-#define UMAC_WIFI_SEQ_NUM_BASE          1
-#define UMAC_WIFI_SEQ_NUM_MAX           0x4000
-#define UMAC_NONWIFI_SEQ_NUM_BASE       1
-#define UMAC_NONWIFI_SEQ_NUM_MAX        0x10
-/* MAC address address */
-#define WICO_MAC_ADDRESS_ADDR               0x604008F8
-/* RA / TID */
-#define UMAC_HDI_ACT_TBL_IDX_TID_POS                  0
-#define UMAC_HDI_ACT_TBL_IDX_TID_SEED                 0xF
-#define UMAC_HDI_ACT_TBL_IDX_RA_POS                   4
-#define UMAC_HDI_ACT_TBL_IDX_RA_SEED                  0xF
-#define UMAC_HDI_ACT_TBL_IDX_RA_UMAC                  0xF
-#define UMAC_HDI_ACT_TBL_IDX_TID_UMAC                 0x9
-#define UMAC_HDI_ACT_TBL_IDX_TID_LMAC                 0xA
-#define UMAC_HDI_ACT_TBL_IDX_HOST_CMD \
-        ((UMAC_HDI_ACT_TBL_IDX_RA_UMAC << UMAC_HDI_ACT_TBL_IDX_RA_POS) |\
-         (UMAC_HDI_ACT_TBL_IDX_TID_UMAC << UMAC_HDI_ACT_TBL_IDX_TID_POS))
-#define UMAC_HDI_ACT_TBL_IDX_UMAC_CMD \
-        ((UMAC_HDI_ACT_TBL_IDX_RA_UMAC << UMAC_HDI_ACT_TBL_IDX_RA_POS) |\
-        (UMAC_HDI_ACT_TBL_IDX_TID_LMAC << UMAC_HDI_ACT_TBL_IDX_TID_POS))
-/* STA ID and color */
-#define STA_ID_SEED                        (0x0f)
-#define STA_ID_POS                         (0)
-#define STA_ID_MSK                         (STA_ID_SEED << STA_ID_POS)
-#define STA_COLOR_SEED                     (0x7)
-#define STA_COLOR_POS                      (4)
-#define STA_COLOR_MSK                      (STA_COLOR_SEED << STA_COLOR_POS)
-#define STA_ID_N_COLOR_COLOR(id_n_color) \
-        (((id_n_color) & STA_COLOR_MSK) >> STA_COLOR_POS)
-#define STA_ID_N_COLOR_ID(id_n_color) \
-        (((id_n_color) & STA_ID_MSK) >> STA_ID_POS)
-/* iwm_umac_notif_alive.page_grp_state Group number -- bits [3:0] */
-#define UMAC_ALIVE_PAGE_STS_GRP_NUM_POS         0
-#define UMAC_ALIVE_PAGE_STS_GRP_NUM_SEED        0xF
-/* iwm_umac_notif_alive.page_grp_state Super group number -- bits [7:4] */
-#define UMAC_ALIVE_PAGE_STS_SGRP_NUM_POS        4
-#define UMAC_ALIVE_PAGE_STS_SGRP_NUM_SEED       0xF
-/* iwm_umac_notif_alive.page_grp_state Group min size -- bits [15:8] */
-#define UMAC_ALIVE_PAGE_STS_GRP_MIN_SIZE_POS    8
-#define UMAC_ALIVE_PAGE_STS_GRP_MIN_SIZE_SEED   0xFF
-/* iwm_umac_notif_alive.page_grp_state Group max size -- bits [23:16] */
-#define UMAC_ALIVE_PAGE_STS_GRP_MAX_SIZE_POS    16
-#define UMAC_ALIVE_PAGE_STS_GRP_MAX_SIZE_SEED   0xFF
-/* iwm_umac_notif_alive.page_grp_state Super group max size -- bits [31:24] */
-#define UMAC_ALIVE_PAGE_STS_SGRP_MAX_SIZE_POS   24
-#define UMAC_ALIVE_PAGE_STS_SGRP_MAX_SIZE_SEED  0xFF
-/* Barkers */
-#define UMAC_REBOOT_BARKER              0xdeadbeef
-#define UMAC_ACK_BARKER                 0xfeedbabe
-#define UMAC_PAD_TERMINAL               0xadadadad
-/* UMAC JMP address */
-#define UMAC_MU_FW_INST_DATA_12_ADDR    0xBF0000
-/* iwm_umac_hdi_out_hdr.cmd OP code -- bits [3:0] */
-#define UMAC_HDI_OUT_CMD_OPCODE_POS     0
-#define UMAC_HDI_OUT_CMD_OPCODE_SEED    0xF
-/* iwm_umac_hdi_out_hdr.cmd End-Of-Transfer -- bits [10:10] */
-#define UMAC_HDI_OUT_CMD_EOT_POS        10
-#define UMAC_HDI_OUT_CMD_EOT_SEED       0x1
-/* iwm_umac_hdi_out_hdr.cmd UTFD only usage -- bits [11:11] */
-#define UMAC_HDI_OUT_CMD_UTFD_ONLY_POS  11
-#define UMAC_HDI_OUT_CMD_UTFD_ONLY_SEED 0x1
-/* iwm_umac_hdi_out_hdr.cmd Non-WiFi HW sequence number -- bits [12:15] */
-#define UDMA_HDI_OUT_CMD_NON_WIFI_HW_SEQ_NUM_POS   12
-#define UDMA_HDI_OUT_CMD_NON_WIFI_HW_SEQ_NUM_SEED  0xF
-/* iwm_umac_hdi_out_hdr.cmd Signature -- bits [31:16] */
-#define UMAC_HDI_OUT_CMD_SIGNATURE_POS  16
-#define UMAC_HDI_OUT_CMD_SIGNATURE_SEED 0xFFFF
-/* iwm_umac_hdi_out_hdr.meta_data Byte count -- bits [11:0] */
-#define UMAC_HDI_OUT_BYTE_COUNT_POS     0
-#define UMAC_HDI_OUT_BYTE_COUNT_SEED    0xFFF
-/* iwm_umac_hdi_out_hdr.meta_data Credit group -- bits [15:12] */
-#define UMAC_HDI_OUT_CREDIT_GRP_POS     12
-#define UMAC_HDI_OUT_CREDIT_GRP_SEED    0xF
-/* iwm_umac_hdi_out_hdr.meta_data RA/TID -- bits [23:16] */
-#define UMAC_HDI_OUT_RATID_POS          16
-#define UMAC_HDI_OUT_RATID_SEED         0xFF
-/* iwm_umac_hdi_out_hdr.meta_data LMAC offset -- bits [31:24] */
-#define UMAC_HDI_OUT_LMAC_OFFSET_POS    24
-#define UMAC_HDI_OUT_LMAC_OFFSET_SEED   0xFF
-/* Signature */
-#define UMAC_HDI_OUT_SIGNATURE          0xCBBC
-/* buffer alignment */
-#define UMAC_HDI_BUF_ALIGN_MSK          0xF
-/*  iwm_umac_hdi_in_hdr.cmd OP code -- bits [3:0] */
-#define UMAC_HDI_IN_CMD_OPCODE_POS                0
-#define UMAC_HDI_IN_CMD_OPCODE_SEED               0xF
-/*  iwm_umac_hdi_in_hdr.cmd Non-WiFi API response -- bits [6:4] */
-#define UMAC_HDI_IN_CMD_NON_WIFI_RESP_POS         4
-#define UMAC_HDI_IN_CMD_NON_WIFI_RESP_SEED        0x7
-/* iwm_umac_hdi_in_hdr.cmd WiFi API source -- bits [5:4] */
-#define UMAC_HDI_IN_CMD_SOURCE_POS                4
-#define UMAC_HDI_IN_CMD_SOURCE_SEED               0x3
-/* iwm_umac_hdi_in_hdr.cmd WiFi API EOT -- bits [6:6] */
-#define UMAC_HDI_IN_CMD_EOT_POS                   6
-#define UMAC_HDI_IN_CMD_EOT_SEED                  0x1
-/* iwm_umac_hdi_in_hdr.cmd timestamp present -- bits [7:7] */
-#define UMAC_HDI_IN_CMD_TIME_STAMP_PRESENT_POS    7
-#define UMAC_HDI_IN_CMD_TIME_STAMP_PRESENT_SEED   0x1
-/* iwm_umac_hdi_in_hdr.cmd WiFi Non-last AMSDU -- bits [8:8] */
-#define UMAC_HDI_IN_CMD_NON_LAST_AMSDU_POS        8
-#define UMAC_HDI_IN_CMD_NON_LAST_AMSDU_SEED       0x1
-/* iwm_umac_hdi_in_hdr.cmd WiFi HW sequence number -- bits [31:9] */
-#define UMAC_HDI_IN_CMD_HW_SEQ_NUM_POS            9
-#define UMAC_HDI_IN_CMD_HW_SEQ_NUM_SEED           0x7FFFFF
-/* iwm_umac_hdi_in_hdr.cmd Non-WiFi HW sequence number -- bits [12:15] */
-#define UDMA_HDI_IN_CMD_NON_WIFI_HW_SEQ_NUM_POS   12
-#define UDMA_HDI_IN_CMD_NON_WIFI_HW_SEQ_NUM_SEED  0xF
-/* iwm_umac_hdi_in_hdr.cmd Non-WiFi HW signature -- bits [16:31] */
-#define UDMA_HDI_IN_CMD_NON_WIFI_HW_SIG_POS       16
-#define UDMA_HDI_IN_CMD_NON_WIFI_HW_SIG_SEED      0xFFFF
-/* Fixed Non-WiFi signature */
-#define UDMA_HDI_IN_CMD_NON_WIFI_HW_SIG           0xCBBC
-/* IN NTFY op-codes */
-#define UMAC_NOTIFY_OPCODE_ALIVE                0xA1
-#define UMAC_NOTIFY_OPCODE_INIT_COMPLETE        0xA2
-#define UMAC_NOTIFY_OPCODE_WIFI_CORE_STATUS     0xA3
-#define UMAC_NOTIFY_OPCODE_ERROR                0xA4
-#define UMAC_NOTIFY_OPCODE_DEBUG                0xA5
-#define UMAC_NOTIFY_OPCODE_WIFI_IF_WRAPPER      0xB0
-#define UMAC_NOTIFY_OPCODE_STATS                0xB1
-#define UMAC_NOTIFY_OPCODE_PAGE_DEALLOC         0xB3
-#define UMAC_NOTIFY_OPCODE_RX_TICKET            0xB4
-#define UMAC_NOTIFY_OPCODE_MAX                  (UMAC_NOTIFY_OPCODE_RX_TICKET -\
-                                                UMAC_NOTIFY_OPCODE_ALIVE + 1)
-#define UMAC_NOTIFY_OPCODE_FIRST                (UMAC_NOTIFY_OPCODE_ALIVE)
-/* HDI OUT OP CODE */
-#define UMAC_HDI_OUT_OPCODE_PING                0x0
-#define UMAC_HDI_OUT_OPCODE_READ                0x1
-#define UMAC_HDI_OUT_OPCODE_WRITE               0x2
-#define UMAC_HDI_OUT_OPCODE_JUMP                0x3
-#define UMAC_HDI_OUT_OPCODE_REBOOT              0x4
-#define UMAC_HDI_OUT_OPCODE_WRITE_PERSISTENT    0x5
-#define UMAC_HDI_OUT_OPCODE_READ_PERSISTENT     0x6
-#define UMAC_HDI_OUT_OPCODE_READ_MODIFY_WRITE   0x7
-/* #define UMAC_HDI_OUT_OPCODE_RESERVED         0x8..0xA */
-#define UMAC_HDI_OUT_OPCODE_WRITE_AUX_REG       0xB
-#define UMAC_HDI_OUT_OPCODE_WIFI                0xF
-/* HDI IN OP CODE -- Non WiFi*/
-#define UMAC_HDI_IN_OPCODE_PING                 0x0
-#define UMAC_HDI_IN_OPCODE_READ                 0x1
-#define UMAC_HDI_IN_OPCODE_WRITE                0x2
-#define UMAC_HDI_IN_OPCODE_WRITE_PERSISTENT     0x5
-#define UMAC_HDI_IN_OPCODE_READ_PERSISTENT      0x6
-#define UMAC_HDI_IN_OPCODE_READ_MODIFY_WRITE    0x7
-#define UMAC_HDI_IN_OPCODE_EP_MGMT              0x8
-#define UMAC_HDI_IN_OPCODE_CREDIT_CHANGE        0x9
-#define UMAC_HDI_IN_OPCODE_CTRL_DATABASE        0xA
-#define UMAC_HDI_IN_OPCODE_WRITE_AUX_REG        0xB
-#define UMAC_HDI_IN_OPCODE_NONWIFI_MAX \
-                (UMAC_HDI_IN_OPCODE_WRITE_AUX_REG + 1)
-#define UMAC_HDI_IN_OPCODE_WIFI                 0xF
-/* HDI IN SOURCE */
-#define UMAC_HDI_IN_SOURCE_FHRX                 0x0
-#define UMAC_HDI_IN_SOURCE_UDMA                 0x1
-#define UMAC_HDI_IN_SOURCE_FW                   0x2
-#define UMAC_HDI_IN_SOURCE_RESERVED             0x3
-/* OUT CMD op-codes */
-#define UMAC_CMD_OPCODE_ECHO                    0x01
-#define UMAC_CMD_OPCODE_HALT                    0x02
-#define UMAC_CMD_OPCODE_RESET                   0x03
-#define UMAC_CMD_OPCODE_BULK_EP_INACT_TIMEOUT   0x09
-#define UMAC_CMD_OPCODE_URB_CANCEL_ACK          0x0A
-#define UMAC_CMD_OPCODE_DCACHE_FLUSH            0x0B
-#define UMAC_CMD_OPCODE_EEPROM_PROXY            0x0C
-#define UMAC_CMD_OPCODE_TX_ECHO                 0x0D
-#define UMAC_CMD_OPCODE_DBG_MON                 0x0E
-#define UMAC_CMD_OPCODE_INTERNAL_TX             0x0F
-#define UMAC_CMD_OPCODE_SET_PARAM_FIX           0x10
-#define UMAC_CMD_OPCODE_SET_PARAM_VAR           0x11
-#define UMAC_CMD_OPCODE_GET_PARAM               0x12
-#define UMAC_CMD_OPCODE_DBG_EVENT_WRAPPER       0x13
-#define UMAC_CMD_OPCODE_TARGET                  0x14
-#define UMAC_CMD_OPCODE_STATISTIC_REQUEST       0x15
-#define UMAC_CMD_OPCODE_GET_CHAN_INFO_LIST      0x16
-#define UMAC_CMD_OPCODE_SET_PARAM_LIST          0x17
-#define UMAC_CMD_OPCODE_GET_PARAM_LIST          0x18
-#define UMAC_CMD_OPCODE_STOP_RESUME_STA_TX      0x19
-#define UMAC_CMD_OPCODE_TEST_BLOCK_ACK          0x1A
-#define UMAC_CMD_OPCODE_BASE_WRAPPER            0xFA
-#define UMAC_CMD_OPCODE_LMAC_WRAPPER            0xFB
-#define UMAC_CMD_OPCODE_HW_TEST_WRAPPER         0xFC
-#define UMAC_CMD_OPCODE_WIFI_IF_WRAPPER         0xFD
-#define UMAC_CMD_OPCODE_WIFI_WRAPPER            0xFE
-#define UMAC_CMD_OPCODE_WIFI_PASS_THROUGH       0xFF
-/* UMAC WiFi interface op-codes */
-#define UMAC_WIFI_IF_CMD_SET_PROFILE                     0x11
-#define UMAC_WIFI_IF_CMD_INVALIDATE_PROFILE              0x12
-#define UMAC_WIFI_IF_CMD_SET_EXCLUDE_LIST                0x13
-#define UMAC_WIFI_IF_CMD_SCAN_REQUEST                    0x14
-#define UMAC_WIFI_IF_CMD_SCAN_CONFIG                     0x15
-#define UMAC_WIFI_IF_CMD_ADD_WEP40_KEY                   0x16
-#define UMAC_WIFI_IF_CMD_ADD_WEP104_KEY                  0x17
-#define UMAC_WIFI_IF_CMD_ADD_TKIP_KEY                    0x18
-#define UMAC_WIFI_IF_CMD_ADD_CCMP_KEY                    0x19
-#define UMAC_WIFI_IF_CMD_REMOVE_KEY                      0x1A
-#define UMAC_WIFI_IF_CMD_GLOBAL_TX_KEY_ID                0x1B
-#define UMAC_WIFI_IF_CMD_SET_HOST_EXTENDED_IE            0x1C
-#define UMAC_WIFI_IF_CMD_GET_SUPPORTED_CHANNELS          0x1E
-#define UMAC_WIFI_IF_CMD_PMKID_UPDATE                    0x1F
-#define UMAC_WIFI_IF_CMD_TX_PWR_TRIGGER                  0x20
-/* UMAC WiFi interface ports */
-#define UMAC_WIFI_IF_FLG_PORT_DEF                        0x00
-#define UMAC_WIFI_IF_FLG_PORT_PAN                        0x01
-#define UMAC_WIFI_IF_FLG_PORT_PAN_INVALID                WIFI_IF_FLG_PORT_DEF
-/* UMAC WiFi interface actions */
-#define UMAC_WIFI_IF_FLG_ACT_GET                         0x10
-#define UMAC_WIFI_IF_FLG_ACT_SET                         0x20
-/* iwm_umac_fw_cmd_hdr.meta_data byte count -- bits [11:0] */
-#define UMAC_FW_CMD_BYTE_COUNT_POS            0
-#define UMAC_FW_CMD_BYTE_COUNT_SEED           0xFFF
-/* iwm_umac_fw_cmd_hdr.meta_data status -- bits [15:12] */
-#define UMAC_FW_CMD_STATUS_POS                12
-#define UMAC_FW_CMD_STATUS_SEED               0xF
-/* iwm_umac_fw_cmd_hdr.meta_data full TX command by Driver -- bits [16:16] */
-#define UMAC_FW_CMD_TX_DRV_FULL_CMD_POS       16
-#define UMAC_FW_CMD_TX_DRV_FULL_CMD_SEED      0x1
-/* iwm_umac_fw_cmd_hdr.meta_data TX command by FW -- bits [17:17] */
-#define UMAC_FW_CMD_TX_FW_CMD_POS             17
-#define UMAC_FW_CMD_TX_FW_CMD_SEED            0x1
-/* iwm_umac_fw_cmd_hdr.meta_data TX plaintext mode -- bits [18:18] */
-#define UMAC_FW_CMD_TX_PLAINTEXT_POS          18
-#define UMAC_FW_CMD_TX_PLAINTEXT_SEED         0x1
-/* iwm_umac_fw_cmd_hdr.meta_data STA color -- bits [22:20] */
-#define UMAC_FW_CMD_TX_STA_COLOR_POS          20
-#define UMAC_FW_CMD_TX_STA_COLOR_SEED         0x7
-/* iwm_umac_fw_cmd_hdr.meta_data TX life time (TU) -- bits [31:24] */
-#define UMAC_FW_CMD_TX_LIFETIME_TU_POS        24
-#define UMAC_FW_CMD_TX_LIFETIME_TU_SEED       0xFF
-/* iwm_dev_cmd_hdr.flags Response required -- bits [5:5] */
-#define UMAC_DEV_CMD_FLAGS_RESP_REQ_POS         5
-#define UMAC_DEV_CMD_FLAGS_RESP_REQ_SEED        0x1
-/* iwm_dev_cmd_hdr.flags Aborted command -- bits [6:6] */
-#define UMAC_DEV_CMD_FLAGS_ABORT_POS            6
-#define UMAC_DEV_CMD_FLAGS_ABORT_SEED           0x1
-/* iwm_dev_cmd_hdr.flags Internal command -- bits [7:7] */
-#define DEV_CMD_FLAGS_FLD_INTERNAL_POS          7
-#define DEV_CMD_FLAGS_FLD_INTERNAL_SEED         0x1
-/* Rx */
-/* Rx actions */
-#define IWM_RX_TICKET_DROP           0x0
-#define IWM_RX_TICKET_RELEASE        0x1
-#define IWM_RX_TICKET_SNIFFER        0x2
-#define IWM_RX_TICKET_ENQUEUE        0x3
-/* Rx flags */
-#define IWM_RX_TICKET_PAD_SIZE_MSK        0x2
-#define IWM_RX_TICKET_SPECIAL_SNAP_MSK    0x4
-#define IWM_RX_TICKET_AMSDU_MSK           0x8
-#define IWM_RX_TICKET_DROP_REASON_POS       4
-#define IWM_RX_TICKET_DROP_REASON_MSK (0x1F << IWM_RX_TICKET_DROP_REASON_POS)
-#define IWM_RX_DROP_NO_DROP                          0x0
-#define IWM_RX_DROP_BAD_CRC                          0x1
-/* L2P no address match */
-#define IWM_RX_DROP_LMAC_ADDR_FILTER                 0x2
-/* Multicast address not in list */
-#define IWM_RX_DROP_MCAST_ADDR_FILTER                0x3
-/* Control frames are not sent to the driver */
-#define IWM_RX_DROP_CTL_FRAME                        0x4
-/* Our frame is back */
-#define IWM_RX_DROP_OUR_TX                           0x5
-/* Association class filtering */
-#define IWM_RX_DROP_CLASS_FILTER                     0x6
-/* Duplicated frame */
-#define IWM_RX_DROP_DUPLICATE_FILTER                 0x7
-/* Decryption error */
-#define IWM_RX_DROP_SEC_ERR                          0x8
-/* Unencrypted frame while encryption is on */
-#define IWM_RX_DROP_SEC_NO_ENCRYPTION                0x9
-/* Replay check failure */
-#define IWM_RX_DROP_SEC_REPLAY_ERR                   0xa
-/* uCode and FW key color mismatch, check before replay */
-#define IWM_RX_DROP_SEC_KEY_COLOR_MISMATCH           0xb
-#define IWM_RX_DROP_SEC_TKIP_COUNTER_MEASURE         0xc
-/* No fragmentations Db is found */
-#define IWM_RX_DROP_FRAG_NO_RESOURCE                 0xd
-/* Fragmention Db has seqCtl mismatch Vs. non-1st frag */
-#define IWM_RX_DROP_FRAG_ERR                         0xe
-#define IWM_RX_DROP_FRAG_LOST                        0xf
-#define IWM_RX_DROP_FRAG_COMPLETE                    0x10
-/* Should be handled by UMAC */
-#define IWM_RX_DROP_MANAGEMENT                       0x11
-/* STA not found by UMAC */
-#define IWM_RX_DROP_NO_STATION                       0x12
-/* NULL or QoS NULL */
-#define IWM_RX_DROP_NULL_DATA                        0x13
-#define IWM_RX_DROP_BA_REORDER_OLD_SEQCTL            0x14
-#define IWM_RX_DROP_BA_REORDER_DUPLICATE             0x15
-struct iwm_rx_ticket {
-        __le16 action;
-        __le16 id;
-        __le16 flags;
-        u8 payload_offset; /* includes: MAC header, pad, IV */
-        u8 tail_len; /* includes: MIC, ICV, CRC (w/o STATUS) */
-} __packed;
-struct iwm_rx_mpdu_hdr {
-        __le16 len;
-        __le16 reserved;
-} __packed;
-/* UMAC SW WIFI API */
-struct iwm_dev_cmd_hdr {
-        u8 cmd;
-        u8 flags;
-        __le16 seq_num;
-} __packed;
-struct iwm_umac_fw_cmd_hdr {
-        __le32 meta_data;
-        struct iwm_dev_cmd_hdr cmd;
-} __packed;
-struct iwm_umac_wifi_out_hdr {
-        struct iwm_udma_out_wifi_hdr hw_hdr;
-        struct iwm_umac_fw_cmd_hdr sw_hdr;
-} __packed;
-struct iwm_umac_nonwifi_out_hdr {
-        struct iwm_udma_out_nonwifi_hdr hw_hdr;
-} __packed;
-struct iwm_umac_wifi_in_hdr {
-        struct iwm_udma_in_hdr hw_hdr;
-        struct iwm_umac_fw_cmd_hdr sw_hdr;
-} __packed;
-struct iwm_umac_nonwifi_in_hdr {
-        struct iwm_udma_in_hdr hw_hdr;
-        __le32 time_stamp;
-} __packed;
-#define IWM_UMAC_PAGE_SIZE      0x200
-/* Notify structures */
-struct iwm_fw_version {
-        u8 minor;
-        u8 major;
-        __le16 id;
-};
-struct iwm_fw_build {
-        u8 type;
-        u8 subtype;
-        u8 platform;
-        u8 opt;
-};
-struct iwm_fw_alive_hdr {
-        struct iwm_fw_version ver;
-        struct iwm_fw_build build;
-        __le32 os_build;
-        __le32 log_hdr_addr;
-        __le32 log_buf_addr;
-        __le32 sys_timer_addr;
-};
-#define WAIT_NOTIF_TIMEOUT     (2 * HZ)
-#define SCAN_COMPLETE_TIMEOUT  (3 * HZ)
-#define UMAC_NTFY_ALIVE_STATUS_ERR              0xDEAD
-#define UMAC_NTFY_ALIVE_STATUS_OK               0xCAFE
-#define UMAC_NTFY_INIT_COMPLETE_STATUS_ERR      0xDEAD
-#define UMAC_NTFY_INIT_COMPLETE_STATUS_OK       0xCAFE
-#define UMAC_NTFY_WIFI_CORE_STATUS_LINK_EN      0x40
-#define UMAC_NTFY_WIFI_CORE_STATUS_MLME_EN      0x80
-#define IWM_MACS_OUT_GROUPS     6
-#define IWM_MACS_OUT_SGROUPS    1
-#define WIFI_IF_NTFY_ASSOC_START                        0x80
-#define WIFI_IF_NTFY_ASSOC_COMPLETE                     0x81
-#define WIFI_IF_NTFY_PROFILE_INVALIDATE_COMPLETE        0x82
-#define WIFI_IF_NTFY_CONNECTION_TERMINATED              0x83
-#define WIFI_IF_NTFY_SCAN_COMPLETE                      0x84
-#define WIFI_IF_NTFY_STA_TABLE_CHANGE                   0x85
-#define WIFI_IF_NTFY_EXTENDED_IE_REQUIRED               0x86
-#define WIFI_IF_NTFY_RADIO_PREEMPTION                   0x87
-#define WIFI_IF_NTFY_BSS_TRK_TABLE_CHANGED              0x88
-#define WIFI_IF_NTFY_BSS_TRK_ENTRIES_REMOVED            0x89
-#define WIFI_IF_NTFY_LINK_QUALITY_STATISTICS            0x8A
-#define WIFI_IF_NTFY_MGMT_FRAME                         0x8B
-/* DEBUG INDICATIONS */
-#define WIFI_DBG_IF_NTFY_SCAN_SUPER_JOB_START           0xE0
-#define WIFI_DBG_IF_NTFY_SCAN_SUPER_JOB_COMPLETE        0xE1
-#define WIFI_DBG_IF_NTFY_SCAN_CHANNEL_START             0xE2
-#define WIFI_DBG_IF_NTFY_SCAN_CHANNEL_RESULT            0xE3
-#define WIFI_DBG_IF_NTFY_SCAN_MINI_JOB_START            0xE4
-#define WIFI_DBG_IF_NTFY_SCAN_MINI_JOB_COMPLETE         0xE5
-#define WIFI_DBG_IF_NTFY_CNCT_ATC_START                 0xE6
-#define WIFI_DBG_IF_NTFY_COEX_NOTIFICATION              0xE7
-#define WIFI_DBG_IF_NTFY_COEX_HANDLE_ENVELOP            0xE8
-#define WIFI_DBG_IF_NTFY_COEX_HANDLE_RELEASE_ENVELOP    0xE9
-#define WIFI_IF_NTFY_MAX 0xff
-/* Notification structures */
-struct iwm_umac_notif_wifi_if {
-        struct iwm_umac_wifi_in_hdr hdr;
-        u8 status;
-        u8 flags;
-        __le16 buf_size;
-} __packed;
-#define UMAC_ROAM_REASON_FIRST_SELECTION        0x1
-#define UMAC_ROAM_REASON_AP_DEAUTH              0x2
-#define UMAC_ROAM_REASON_AP_CONNECT_LOST        0x3
-#define UMAC_ROAM_REASON_RSSI                   0x4
-#define UMAC_ROAM_REASON_AP_ASSISTED_ROAM       0x5
-#define UMAC_ROAM_REASON_IBSS_COALESCING        0x6
-struct iwm_umac_notif_assoc_start {
-        struct iwm_umac_notif_wifi_if mlme_hdr;
-        __le32 roam_reason;
-        u8 bssid[ETH_ALEN];
-        u8 reserved[2];
-} __packed;
-#define UMAC_ASSOC_COMPLETE_SUCCESS             0x0
-#define UMAC_ASSOC_COMPLETE_FAILURE             0x1
-struct iwm_umac_notif_assoc_complete {
-        struct iwm_umac_notif_wifi_if mlme_hdr;
-        __le32 status;
-        u8 bssid[ETH_ALEN];
-        u8 band;
-        u8 channel;
-} __packed;
-#define UMAC_PROFILE_INVALID_ASSOC_TIMEOUT      0x0
-#define UMAC_PROFILE_INVALID_ROAM_TIMEOUT       0x1
-#define UMAC_PROFILE_INVALID_REQUEST            0x2
-#define UMAC_PROFILE_INVALID_RF_PREEMPTED       0x3
-struct iwm_umac_notif_profile_invalidate {
-        struct iwm_umac_notif_wifi_if mlme_hdr;
-        __le32 reason;
-} __packed;
-#define UMAC_SCAN_RESULT_SUCCESS  0x0
-#define UMAC_SCAN_RESULT_ABORTED  0x1
-#define UMAC_SCAN_RESULT_REJECTED 0x2
-#define UMAC_SCAN_RESULT_FAILED   0x3
-struct iwm_umac_notif_scan_complete {
-        struct iwm_umac_notif_wifi_if mlme_hdr;
-        __le32 type;
-        __le32 result;
-        u8 seq_num;
-} __packed;
-#define UMAC_OPCODE_ADD_MODIFY  0x0
-#define UMAC_OPCODE_REMOVE      0x1
-#define UMAC_OPCODE_CLEAR_ALL   0x2
-#define UMAC_STA_FLAG_QOS       0x1
-struct iwm_umac_notif_sta_info {
-        struct iwm_umac_notif_wifi_if mlme_hdr;
-        __le32 opcode;
-        u8 mac_addr[ETH_ALEN];
-        u8 sta_id; /* bits 0-3: station ID, bits 4-7: station color */
-        u8 flags;
-} __packed;
-#define UMAC_BAND_2GHZ 0
-#define UMAC_BAND_5GHZ 1
-#define UMAC_CHANNEL_WIDTH_20MHZ 0
-#define UMAC_CHANNEL_WIDTH_40MHZ 1
-struct iwm_umac_notif_bss_info {
-        struct iwm_umac_notif_wifi_if mlme_hdr;
-        __le32 type;
-        __le32 timestamp;
-        __le16 table_idx;
-        __le16 frame_len;
-        u8 band;
-        u8 channel;
-        s8 rssi;
-        u8 reserved;
-        u8 frame_buf[1];
-} __packed;
-#define IWM_BSS_REMOVE_INDEX_MSK           0x0fff
-#define IWM_BSS_REMOVE_FLAGS_MSK           0xfc00
-#define IWM_BSS_REMOVE_FLG_AGE             0x1000
-#define IWM_BSS_REMOVE_FLG_TIMEOUT         0x2000
-#define IWM_BSS_REMOVE_FLG_TABLE_FULL      0x4000
-struct iwm_umac_notif_bss_removed {
-        struct iwm_umac_notif_wifi_if mlme_hdr;
-        __le32 count;
-        __le16 entries[0];
-} __packed;
-struct iwm_umac_notif_mgt_frame {
-        struct iwm_umac_notif_wifi_if mlme_hdr;
-        __le16 len;
-        u8 frame[1];
-} __packed;
-struct iwm_umac_notif_alive {
-        struct iwm_umac_wifi_in_hdr hdr;
-        __le16 status;
-        __le16 reserved1;
-        struct iwm_fw_alive_hdr alive_data;
-        __le16 reserved2;
-        __le16 page_grp_count;
-        __le32 page_grp_state[IWM_MACS_OUT_GROUPS];
-} __packed;
-struct iwm_umac_notif_init_complete {
-        struct iwm_umac_wifi_in_hdr hdr;
-        __le16 status;
-        __le16 reserved;
-} __packed;
-/* error categories */
-enum {
-        UMAC_SYS_ERR_CAT_NONE = 0,
-        UMAC_SYS_ERR_CAT_BOOT,
-        UMAC_SYS_ERR_CAT_UMAC,
-        UMAC_SYS_ERR_CAT_UAXM,
-        UMAC_SYS_ERR_CAT_LMAC,
-        UMAC_SYS_ERR_CAT_MAX
-};
-struct iwm_fw_error_hdr {
-        __le32 category;
-        __le32 status;
-        __le32 pc;
-        __le32 blink1;
-        __le32 blink2;
-        __le32 ilink1;
-        __le32 ilink2;
-        __le32 data1;
-        __le32 data2;
-        __le32 line_num;
-        __le32 umac_status;
-        __le32 lmac_status;
-        __le32 sdio_status;
-        __le32 dbm_sample_ctrl;
-        __le32 dbm_buf_base;
-        __le32 dbm_buf_end;
-        __le32 dbm_buf_write_ptr;
-        __le32 dbm_buf_cycle_cnt;
-} __packed;
-struct iwm_umac_notif_error {
-        struct iwm_umac_wifi_in_hdr hdr;
-        struct iwm_fw_error_hdr err;
-} __packed;
-#define UMAC_DEALLOC_NTFY_CHANGES_CNT_POS       0
-#define UMAC_DEALLOC_NTFY_CHANGES_CNT_SEED      0xff
-#define UMAC_DEALLOC_NTFY_CHANGES_MSK_POS       8
-#define UMAC_DEALLOC_NTFY_CHANGES_MSK_SEED      0xffffff
-#define UMAC_DEALLOC_NTFY_PAGE_CNT_POS          0
-#define UMAC_DEALLOC_NTFY_PAGE_CNT_SEED         0xffffff
-#define UMAC_DEALLOC_NTFY_GROUP_NUM_POS         24
-#define UMAC_DEALLOC_NTFY_GROUP_NUM_SEED        0xf
-struct iwm_umac_notif_page_dealloc {
-        struct iwm_umac_wifi_in_hdr hdr;
-        __le32 changes;
-        __le32 grp_info[IWM_MACS_OUT_GROUPS];
-} __packed;
-struct iwm_umac_notif_wifi_status {
-        struct iwm_umac_wifi_in_hdr hdr;
-        __le16 status;
-        __le16 reserved;
-} __packed;
-struct iwm_umac_notif_rx_ticket {
-        struct iwm_umac_wifi_in_hdr hdr;
-        u8 num_tickets;
-        u8 reserved[3];
-        struct iwm_rx_ticket tickets[1];
-} __packed;
-/* Tx/Rx rates window (number of max of last update window per second) */
-#define UMAC_NTF_RATE_SAMPLE_NR 4
-/* Max numbers of bits required to go through all antennae in bitmasks */
-#define UMAC_PHY_NUM_CHAINS     3
-#define IWM_UMAC_MGMT_TID       8
-#define IWM_UMAC_TID_NR         9 /* 8 TIDs + MGMT */
-struct iwm_umac_notif_stats {
-        struct iwm_umac_wifi_in_hdr hdr;
-        __le32 flags;
-        __le32 timestamp;
-        __le16 tid_load[IWM_UMAC_TID_NR + 1]; /* 1 non-QoS + 1 dword align */
-        __le16 tx_rate[UMAC_NTF_RATE_SAMPLE_NR];
-        __le16 rx_rate[UMAC_NTF_RATE_SAMPLE_NR];
-        __le32 chain_energy[UMAC_PHY_NUM_CHAINS];
-        s32 rssi_dbm;
-        s32 noise_dbm;
-        __le32 supp_rates;
-        __le32 supp_ht_rates;
-        __le32 missed_beacons;
-        __le32 rx_beacons;
-        __le32 rx_dir_pkts;
-        __le32 rx_nondir_pkts;
-        __le32 rx_multicast;
-        __le32 rx_errors;
-        __le32 rx_drop_other_bssid;
-        __le32 rx_drop_decode;
-        __le32 rx_drop_reassembly;
-        __le32 rx_drop_bad_len;
-        __le32 rx_drop_overflow;
-        __le32 rx_drop_crc;
-        __le32 rx_drop_missed;
-        __le32 tx_dir_pkts;
-        __le32 tx_nondir_pkts;
-        __le32 tx_failure;
-        __le32 tx_errors;
-        __le32 tx_drop_max_retry;
-        __le32 tx_err_abort;
-        __le32 tx_err_carrier;
-        __le32 rx_bytes;
-        __le32 tx_bytes;
-        __le32 tx_power;
-        __le32 tx_max_power;
-        __le32 roam_threshold;
-        __le32 ap_assoc_nr;
-        __le32 scan_full;
-        __le32 scan_abort;
-        __le32 ap_nr;
-        __le32 roam_nr;
-        __le32 roam_missed_beacons;
-        __le32 roam_rssi;
-        __le32 roam_unassoc;
-        __le32 roam_deauth;
-        __le32 roam_ap_loadblance;
-} __packed;
-#define UMAC_STOP_TX_FLAG    0x1
-#define UMAC_RESUME_TX_FLAG  0x2
-#define LAST_SEQ_NUM_INVALID     0xFFFF
-struct iwm_umac_notif_stop_resume_tx {
-        struct iwm_umac_wifi_in_hdr hdr;
-        u8 flags; /* UMAC_*_TX_FLAG_* */
-        u8 sta_id;
-        __le16 stop_resume_tid_msk; /* tid bitmask */
-} __packed;
-#define UMAC_MAX_NUM_PMKIDS 4
-/* WiFi interface wrapper header */
-struct iwm_umac_wifi_if {
-        u8 oid;
-        u8 flags;
-        __le16 buf_size;
-} __packed;
-#define IWM_SEQ_NUM_HOST_MSK    0x0000
-#define IWM_SEQ_NUM_UMAC_MSK    0x4000
-#define IWM_SEQ_NUM_LMAC_MSK    0x8000
-#define IWM_SEQ_NUM_MSK         0xC000
-#endif
diff --git a/drivers/net/wireless/libertas/host.h b/drivers/net/wireless/libertas/host.h
index 2e2dbfa2ee50..96726f79a1dd 100644
--- a/drivers/net/wireless/libertas/host.h
+++ b/drivers/net/wireless/libertas/host.h
@@ -68,7 +68,6 @@
 #define CMD_802_11_BEACON_STOP                  0x0049
 #define CMD_802_11_MAC_ADDRESS                  0x004d
 #define CMD_802_11_LED_GPIO_CTRL                0x004e
-#define CMD_802_11_EEPROM_ACCESS                0x0059
 #define CMD_802_11_BAND_CONFIG                  0x0058
 #define CMD_GSPI_BUS_CONFIG                     0x005a
 #define CMD_802_11D_DOMAIN_INFO                 0x005b
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index f578d0b2172d..200bcc0ead98 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -292,7 +292,7 @@ struct mac80211_hwsim_data {
        struct list_head list;
        struct ieee80211_hw *hw;
        struct device *dev;
-        struct ieee80211_supported_band bands[2];
+        struct ieee80211_supported_band bands[IEEE80211_NUM_BANDS];
        struct ieee80211_channel channels_2ghz[ARRAY_SIZE(hwsim_channels_2ghz)];
        struct ieee80211_channel channels_5ghz[ARRAY_SIZE(hwsim_channels_5ghz)];
        struct ieee80211_rate rates[ARRAY_SIZE(hwsim_rates)];
@@ -1082,6 +1082,8 @@ enum hwsim_testmode_attr {
 enum hwsim_testmode_cmd {
        HWSIM_TM_CMD_SET_PS             = 0,
        HWSIM_TM_CMD_GET_PS             = 1,
+        HWSIM_TM_CMD_STOP_QUEUES        = 2,
+        HWSIM_TM_CMD_WAKE_QUEUES        = 3,
 };
 static const struct nla_policy hwsim_testmode_policy[HWSIM_TM_ATTR_MAX + 1] = {
@@ -1121,6 +1123,12 @@ static int mac80211_hwsim_testmode_cmd(struct ieee80211_hw *hw,
                if (nla_put_u32(skb, HWSIM_TM_ATTR_PS, hwsim->ps))
                        goto nla_put_failure;
                return cfg80211_testmode_reply(skb);
+        case HWSIM_TM_CMD_STOP_QUEUES:
+                ieee80211_stop_queues(hw);
+                return 0;
+        case HWSIM_TM_CMD_WAKE_QUEUES:
+                ieee80211_wake_queues(hw);
+                return 0;
        default:
                return -EOPNOTSUPP;
        }
@@ -1855,7 +1863,7 @@ static int __init init_mac80211_hwsim(void)
                                sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
                                break;
                        default:
-                                break;
+                                continue;
                        }
                        sband->ht_cap.ht_supported = true;
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 3af88b8cfcb7..c7a177c62625 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -914,6 +914,69 @@ static int mwifiex_cfg80211_set_cqm_rssi_config(struct wiphy *wiphy,
        return 0;
 }
+/* cfg80211 operation handler for change_beacon.
+ * Function retrieves and sets modified management IEs to FW.
+ */
+static int mwifiex_cfg80211_change_beacon(struct wiphy *wiphy,
+                                          struct net_device *dev,
+                                          struct cfg80211_beacon_data *data)
+{
+        struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+        if (priv->bss_type != MWIFIEX_BSS_TYPE_UAP) {
+                wiphy_err(wiphy, "%s: bss_type mismatched\n", __func__);
+                return -EINVAL;
+        }
+        if (!priv->bss_started) {
+                wiphy_err(wiphy, "%s: bss not started\n", __func__);
+                return -EINVAL;
+        }
+        if (mwifiex_set_mgmt_ies(priv, data)) {
+                wiphy_err(wiphy, "%s: setting mgmt ies failed\n", __func__);
+                return -EFAULT;
+        }
+        return 0;
+}
+static int
+mwifiex_cfg80211_set_antenna(struct wiphy *wiphy, u32 tx_ant, u32 rx_ant)
+{
+        struct mwifiex_adapter *adapter = mwifiex_cfg80211_get_adapter(wiphy);
+        struct mwifiex_private *priv = mwifiex_get_priv(adapter,
+                                                        MWIFIEX_BSS_ROLE_ANY);
+        struct mwifiex_ds_ant_cfg ant_cfg;
+        if (!tx_ant || !rx_ant)
+                return -EOPNOTSUPP;
+        if (adapter->hw_dev_mcs_support != HT_STREAM_2X2) {
+                /* Not a MIMO chip. User should provide specific antenna number
+                 * for Tx/Rx path or enable all antennas for diversity
+                 */
+                if (tx_ant != rx_ant)
+                        return -EOPNOTSUPP;
+                if ((tx_ant & (tx_ant - 1)) &&
+                    (tx_ant != BIT(adapter->number_of_antenna) - 1))
+                        return -EOPNOTSUPP;
+                if ((tx_ant == BIT(adapter->number_of_antenna) - 1) &&
+                    (priv->adapter->number_of_antenna > 1)) {
+                        tx_ant = RF_ANTENNA_AUTO;
+                        rx_ant = RF_ANTENNA_AUTO;
+                }
+        }
+        ant_cfg.tx_ant = tx_ant;
+        ant_cfg.rx_ant = rx_ant;
+        return mwifiex_send_cmd_sync(priv, HostCmd_CMD_RF_ANTENNA,
+                                     HostCmd_ACT_GEN_SET, 0, &ant_cfg);
+}
 /* cfg80211 operation handler for stop ap.
 * Function stops BSS running at uAP interface.
 */
@@ -947,7 +1010,7 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
        if (priv->bss_type != MWIFIEX_BSS_TYPE_UAP)
                return -1;
-        if (mwifiex_set_mgmt_ies(priv, params))
+        if (mwifiex_set_mgmt_ies(priv, &params->beacon))
                return -1;
        bss_cfg = kzalloc(sizeof(struct mwifiex_uap_bss_param), GFP_KERNEL);
@@ -1697,7 +1760,9 @@ static struct cfg80211_ops mwifiex_cfg80211_ops = {
        .set_bitrate_mask = mwifiex_cfg80211_set_bitrate_mask,
        .start_ap = mwifiex_cfg80211_start_ap,
        .stop_ap = mwifiex_cfg80211_stop_ap,
+        .change_beacon = mwifiex_cfg80211_change_beacon,
        .set_cqm_rssi_config = mwifiex_cfg80211_set_cqm_rssi_config,
+        .set_antenna = mwifiex_cfg80211_set_antenna,
 };
 /*
@@ -1744,7 +1809,14 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
        memcpy(wiphy->perm_addr, priv->curr_addr, ETH_ALEN);
        wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
-        wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME;
+        wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME |
+                        WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
+        wiphy->probe_resp_offload = NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS |
+                                    NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2;
+        wiphy->available_antennas_tx = BIT(adapter->number_of_antenna) - 1;
+        wiphy->available_antennas_rx = BIT(adapter->number_of_antenna) - 1;
        /* Reserve space for mwifiex specific private data for BSS */
        wiphy->bss_priv_size = sizeof(struct mwifiex_bss_priv);
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index ffb6cdfdb797..14e985d01dee 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -227,6 +227,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define HostCmd_CMD_PMIC_REG_ACCESS                   0x00ad
 #define HostCmd_CMD_802_11_RF_CHANNEL                 0x001d
 #define HostCmd_CMD_RF_TX_PWR                         0x001e
+#define HostCmd_CMD_RF_ANTENNA                        0x0020
 #define HostCmd_CMD_802_11_DEAUTHENTICATE             0x0024
 #define HostCmd_CMD_MAC_CONTROL                       0x0028
 #define HostCmd_CMD_802_11_AD_HOC_START               0x002b
@@ -322,6 +323,12 @@ enum ENH_PS_MODES {
 #define HostCmd_BSS_TYPE_MASK           0xf000
+#define HostCmd_ACT_SET_RX              0x0001
+#define HostCmd_ACT_SET_TX              0x0002
+#define HostCmd_ACT_SET_BOTH            0x0003
+#define RF_ANTENNA_AUTO                 0xFFFF
 #define HostCmd_SET_SEQ_NO_BSS_INFO(seq, num, type) {   \
        (((seq) & 0x00ff) |                             \
         (((num) & 0x000f) << 8)) |                     \
@@ -884,6 +891,18 @@ struct host_cmd_ds_rf_tx_pwr {
        u8 min_power;
 } __packed;
+struct host_cmd_ds_rf_ant_mimo {
+        __le16 action_tx;
+        __le16 tx_ant_mode;
+        __le16 action_rx;
+        __le16 rx_ant_mode;
+};
+struct host_cmd_ds_rf_ant_siso {
+        __le16 action;
+        __le16 ant_mode;
+};
 struct mwifiex_bcn_param {
        u8 bssid[ETH_ALEN];
        u8 rssi;
@@ -1370,6 +1389,8 @@ struct host_cmd_ds_command {
                struct host_cmd_ds_tx_rate_cfg tx_rate_cfg;
                struct host_cmd_ds_txpwr_cfg txp_cfg;
                struct host_cmd_ds_rf_tx_pwr txp;
+                struct host_cmd_ds_rf_ant_mimo ant_mimo;
+                struct host_cmd_ds_rf_ant_siso ant_siso;
                struct host_cmd_ds_802_11_ps_mode_enh psmode_enh;
                struct host_cmd_ds_802_11_hs_cfg_enh opt_hs_cfg;
                struct host_cmd_ds_802_11_scan scan;
diff --git a/drivers/net/wireless/mwifiex/ie.c b/drivers/net/wireless/mwifiex/ie.c
index 8374e33f195a..1d8dd003e396 100644
--- a/drivers/net/wireless/mwifiex/ie.c
+++ b/drivers/net/wireless/mwifiex/ie.c
@@ -51,8 +51,7 @@ mwifiex_ie_get_autoidx(struct mwifiex_private *priv, u16 subtype_mask,
        for (i = 0; i < priv->adapter->max_mgmt_ie_index; i++) {
                mask = le16_to_cpu(priv->mgmt_ie[i].mgmt_subtype_mask);
-                len = le16_to_cpu(priv->mgmt_ie[i].ie_length) +
+                len = le16_to_cpu(ie->ie_length);
-                      le16_to_cpu(ie->ie_length);
                if (mask == MWIFIEX_AUTO_IDX_MASK)
                        continue;
@@ -108,10 +107,8 @@ mwifiex_update_autoindex_ies(struct mwifiex_private *priv,
                                return -1;
                        tmp = (u8 *)&priv->mgmt_ie[index].ie_buffer;
-                        tmp += le16_to_cpu(priv->mgmt_ie[index].ie_length);
                        memcpy(tmp, &ie->ie_buffer, le16_to_cpu(ie->ie_length));
-                        le16_add_cpu(&priv->mgmt_ie[index].ie_length,
+                        priv->mgmt_ie[index].ie_length = ie->ie_length;
-                                     le16_to_cpu(ie->ie_length));
                        priv->mgmt_ie[index].ie_index = cpu_to_le16(index);
                        priv->mgmt_ie[index].mgmt_subtype_mask =
                                                        cpu_to_le16(mask);
@@ -217,34 +214,107 @@ mwifiex_update_uap_custom_ie(struct mwifiex_private *priv,
        return ret;
 }
-/* This function parses different IEs- Tail IEs, beacon IEs, probe response IEs,
+/* This function checks if WPS IE is present in passed buffer and copies it to
+ * mwifiex_ie structure.
+ * Function takes pointer to struct mwifiex_ie pointer as argument.
+ * If WPS IE is present memory is allocated for mwifiex_ie pointer and filled
+ * in with WPS IE. Caller should take care of freeing this memory.
+ */
+static int mwifiex_update_wps_ie(const u8 *ies, int ies_len,
+                                 struct mwifiex_ie **ie_ptr, u16 mask)
+{
+        struct ieee_types_header *wps_ie;
+        struct mwifiex_ie *ie = NULL;
+        const u8 *vendor_ie;
+        vendor_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
+                                            WLAN_OUI_TYPE_MICROSOFT_WPS,
+                                            ies, ies_len);
+        if (vendor_ie) {
+                ie = kmalloc(sizeof(struct mwifiex_ie), GFP_KERNEL);
+                if (!ie)
+                        return -ENOMEM;
+                wps_ie = (struct ieee_types_header *)vendor_ie;
+                memcpy(ie->ie_buffer, wps_ie, wps_ie->len + 2);
+                ie->ie_length = cpu_to_le16(wps_ie->len + 2);
+                ie->mgmt_subtype_mask = cpu_to_le16(mask);
+                ie->ie_index = cpu_to_le16(MWIFIEX_AUTO_IDX_MASK);
+        }
+        *ie_ptr = ie;
+        return 0;
+}
+/* This function parses beacon IEs, probe response IEs, association response IEs
+ * from cfg80211_ap_settings->beacon and sets these IE to FW.
+ */
+static int mwifiex_set_mgmt_beacon_data_ies(struct mwifiex_private *priv,
+                                            struct cfg80211_beacon_data *data)
+{
+        struct mwifiex_ie *beacon_ie = NULL, *pr_ie = NULL, *ar_ie = NULL;
+        u16 beacon_idx = MWIFIEX_AUTO_IDX_MASK, pr_idx = MWIFIEX_AUTO_IDX_MASK;
+        u16 ar_idx = MWIFIEX_AUTO_IDX_MASK;
+        int ret = 0;
+        if (data->beacon_ies && data->beacon_ies_len)
+                mwifiex_update_wps_ie(data->beacon_ies, data->beacon_ies_len,
+                                      &beacon_ie, MGMT_MASK_BEACON);
+        if (data->proberesp_ies && data->proberesp_ies_len)
+                mwifiex_update_wps_ie(data->proberesp_ies,
+                                      data->proberesp_ies_len, &pr_ie,
+                                      MGMT_MASK_PROBE_RESP);
+        if (data->assocresp_ies && data->assocresp_ies_len)
+                mwifiex_update_wps_ie(data->assocresp_ies,
+                                      data->assocresp_ies_len, &ar_ie,
+                                      MGMT_MASK_ASSOC_RESP |
+                                      MGMT_MASK_REASSOC_RESP);
+        if (beacon_ie || pr_ie || ar_ie) {
+                ret = mwifiex_update_uap_custom_ie(priv, beacon_ie,
+                                                   &beacon_idx, pr_ie,
+                                                   &pr_idx, ar_ie, &ar_idx);
+                if (ret)
+                        goto done;
+        }
+        priv->beacon_idx = beacon_idx;
+        priv->proberesp_idx = pr_idx;
+        priv->assocresp_idx = ar_idx;
+done:
+        kfree(beacon_ie);
+        kfree(pr_ie);
+        kfree(ar_ie);
+        return ret;
+}
+/* This function parses different IEs-tail IEs, beacon IEs, probe response IEs,
 * association response IEs from cfg80211_ap_settings function and sets these IE
 * to FW.
 */
 int mwifiex_set_mgmt_ies(struct mwifiex_private *priv,
-                         struct cfg80211_ap_settings *params)
+                         struct cfg80211_beacon_data *info)
 {
-        struct mwifiex_ie *beacon_ie = NULL, *pr_ie = NULL;
+        struct mwifiex_ie *gen_ie;
-        struct mwifiex_ie *ar_ie = NULL, *gen_ie = NULL;
+        struct ieee_types_header *rsn_ie, *wpa_ie = NULL;
-        struct ieee_types_header *rsn_ie = NULL, *wpa_ie = NULL;
+        u16 rsn_idx = MWIFIEX_AUTO_IDX_MASK, ie_len = 0;
-        u16 beacon_idx = MWIFIEX_AUTO_IDX_MASK, pr_idx = MWIFIEX_AUTO_IDX_MASK;
-        u16 ar_idx = MWIFIEX_AUTO_IDX_MASK, rsn_idx = MWIFIEX_AUTO_IDX_MASK;
-        u16 mask, ie_len = 0;
        const u8 *vendor_ie;
-        int ret = 0;
-        if (params->beacon.tail && params->beacon.tail_len) {
+        if (info->tail && info->tail_len) {
                gen_ie = kzalloc(sizeof(struct mwifiex_ie), GFP_KERNEL);
                if (!gen_ie)
                        return -ENOMEM;
                gen_ie->ie_index = cpu_to_le16(rsn_idx);
-                mask = MGMT_MASK_BEACON | MGMT_MASK_PROBE_RESP |
+                gen_ie->mgmt_subtype_mask = cpu_to_le16(MGMT_MASK_BEACON |
-                       MGMT_MASK_ASSOC_RESP;
+                                                        MGMT_MASK_PROBE_RESP |
-                gen_ie->mgmt_subtype_mask = cpu_to_le16(mask);
+                                                        MGMT_MASK_ASSOC_RESP);
                rsn_ie = (void *)cfg80211_find_ie(WLAN_EID_RSN,
-                                                  params->beacon.tail,
+                                                  info->tail, info->tail_len);
-                                                  params->beacon.tail_len);
                if (rsn_ie) {
                        memcpy(gen_ie->ie_buffer, rsn_ie, rsn_ie->len + 2);
                        ie_len = rsn_ie->len + 2;
@@ -253,8 +323,8 @@ int mwifiex_set_mgmt_ies(struct mwifiex_private *priv,
                vendor_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
                                                    WLAN_OUI_TYPE_MICROSOFT_WPA,
-                                                    params->beacon.tail,
+                                                    info->tail,
-                                                    params->beacon.tail_len);
+                                                    info->tail_len);
                if (vendor_ie) {
                        wpa_ie = (struct ieee_types_header *)vendor_ie;
                        memcpy(gen_ie->ie_buffer + ie_len,
@@ -267,79 +337,16 @@ int mwifiex_set_mgmt_ies(struct mwifiex_private *priv,
                        if (mwifiex_update_uap_custom_ie(priv, gen_ie, &rsn_idx,
                                                         NULL, NULL,
                                                         NULL, NULL)) {
-                                ret = -1;
+                                kfree(gen_ie);
-                                goto done;
+                                return -1;
                        }
                        priv->rsn_idx = rsn_idx;
                }
-        }
-        if (params->beacon.beacon_ies && params->beacon.beacon_ies_len) {
-                beacon_ie = kmalloc(sizeof(struct mwifiex_ie), GFP_KERNEL);
-                if (!beacon_ie) {
-                        ret = -ENOMEM;
-                        goto done;
-                }
-                beacon_ie->ie_index = cpu_to_le16(beacon_idx);
-                beacon_ie->mgmt_subtype_mask = cpu_to_le16(MGMT_MASK_BEACON);
-                beacon_ie->ie_length =
-                                cpu_to_le16(params->beacon.beacon_ies_len);
-                memcpy(beacon_ie->ie_buffer, params->beacon.beacon_ies,
-                       params->beacon.beacon_ies_len);
-        }
-        if (params->beacon.proberesp_ies && params->beacon.proberesp_ies_len) {
-                pr_ie = kmalloc(sizeof(struct mwifiex_ie), GFP_KERNEL);
-                if (!pr_ie) {
-                        ret = -ENOMEM;
-                        goto done;
-                }
-                pr_ie->ie_index = cpu_to_le16(pr_idx);
-                pr_ie->mgmt_subtype_mask = cpu_to_le16(MGMT_MASK_PROBE_RESP);
-                pr_ie->ie_length =
-                                cpu_to_le16(params->beacon.proberesp_ies_len);
-                memcpy(pr_ie->ie_buffer, params->beacon.proberesp_ies,
-                       params->beacon.proberesp_ies_len);
-        }
-        if (params->beacon.assocresp_ies && params->beacon.assocresp_ies_len) {
-                ar_ie = kmalloc(sizeof(struct mwifiex_ie), GFP_KERNEL);
-                if (!ar_ie) {
-                        ret = -ENOMEM;
-                        goto done;
-                }
-                ar_ie->ie_index = cpu_to_le16(ar_idx);
+                kfree(gen_ie);
-                mask = MGMT_MASK_ASSOC_RESP | MGMT_MASK_REASSOC_RESP;
-                ar_ie->mgmt_subtype_mask = cpu_to_le16(mask);
-                ar_ie->ie_length =
-                                cpu_to_le16(params->beacon.assocresp_ies_len);
-                memcpy(ar_ie->ie_buffer, params->beacon.assocresp_ies,
-                       params->beacon.assocresp_ies_len);
-        }
-        if (beacon_ie || pr_ie || ar_ie) {
-                ret = mwifiex_update_uap_custom_ie(priv, beacon_ie,
-                                                   &beacon_idx, pr_ie,
-                                                   &pr_idx, ar_ie, &ar_idx);
-                if (ret)
-                        goto done;
        }
-        priv->beacon_idx = beacon_idx;
+        return mwifiex_set_mgmt_beacon_data_ies(priv, info);
-        priv->proberesp_idx = pr_idx;
-        priv->assocresp_idx = ar_idx;
-done:
-        kfree(beacon_ie);
-        kfree(pr_ie);
-        kfree(ar_ie);
-        kfree(gen_ie);
-        return ret;
 }
 /* This function removes management IE set */
diff --git a/drivers/net/wireless/mwifiex/ioctl.h b/drivers/net/wireless/mwifiex/ioctl.h
index 9f088fb88cb7..e121294cc1ac 100644
--- a/drivers/net/wireless/mwifiex/ioctl.h
+++ b/drivers/net/wireless/mwifiex/ioctl.h
@@ -277,6 +277,11 @@ struct mwifiex_ds_11n_amsdu_aggr_ctrl {
        u16 curr_buf_size;
 };
+struct mwifiex_ds_ant_cfg {
+        u32 tx_ant;
+        u32 rx_ant;
+};
 #define MWIFIEX_NUM_OF_CMD_BUFFER       20
 #define MWIFIEX_SIZE_OF_CMD_BUFFER      2048
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index 7cd95cc99a85..9e636535cbf6 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -1013,7 +1013,7 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct net_device *dev);
 void mwifiex_set_sys_config_invalid_data(struct mwifiex_uap_bss_param *config);
 int mwifiex_set_mgmt_ies(struct mwifiex_private *priv,
-                         struct cfg80211_ap_settings *params);
+                         struct cfg80211_beacon_data *data);
 int mwifiex_del_mgmt_ies(struct mwifiex_private *priv);
 u8 *mwifiex_11d_code_2_region(u8 code);
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index b9cd9ed48c45..225d4c776177 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -277,6 +277,39 @@ static int mwifiex_cmd_rf_tx_power(struct mwifiex_private *priv,
 }
 /*
+ * This function prepares command to set rf antenna.
+ */
+static int mwifiex_cmd_rf_antenna(struct mwifiex_private *priv,
+                                  struct host_cmd_ds_command *cmd,
+                                  u16 cmd_action,
+                                  struct mwifiex_ds_ant_cfg *ant_cfg)
+{
+        struct host_cmd_ds_rf_ant_mimo *ant_mimo = &cmd->params.ant_mimo;
+        struct host_cmd_ds_rf_ant_siso *ant_siso = &cmd->params.ant_siso;
+        cmd->command = cpu_to_le16(HostCmd_CMD_RF_ANTENNA);
+        if (cmd_action != HostCmd_ACT_GEN_SET)
+                return 0;
+        if (priv->adapter->hw_dev_mcs_support == HT_STREAM_2X2) {
+                cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_rf_ant_mimo) +
+                                        S_DS_GEN);
+                ant_mimo->action_tx = cpu_to_le16(HostCmd_ACT_SET_TX);
+                ant_mimo->tx_ant_mode = cpu_to_le16((u16)ant_cfg->tx_ant);
+                ant_mimo->action_rx = cpu_to_le16(HostCmd_ACT_SET_RX);
+                ant_mimo->rx_ant_mode = cpu_to_le16((u16)ant_cfg->rx_ant);
+        } else {
+                cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_rf_ant_siso) +
+                                        S_DS_GEN);
+                ant_siso->action = cpu_to_le16(HostCmd_ACT_SET_BOTH);
+                ant_siso->ant_mode = cpu_to_le16((u16)ant_cfg->tx_ant);
+        }
+        return 0;
+}
+/*
 * This function prepares command to set Host Sleep configuration.
 *
 * Preparation includes -
@@ -1070,6 +1103,10 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
                ret = mwifiex_cmd_rf_tx_power(priv, cmd_ptr, cmd_action,
                                              data_buf);
                break;
+        case HostCmd_CMD_RF_ANTENNA:
+                ret = mwifiex_cmd_rf_antenna(priv, cmd_ptr, cmd_action,
+                                             data_buf);
+                break;
        case HostCmd_CMD_802_11_PS_MODE_ENH:
                ret = mwifiex_cmd_enh_power_mode(priv, cmd_ptr, cmd_action,
                                                 (uint16_t)cmd_oid, data_buf);
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index 78fc352c85c4..97715dfbdf58 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -475,6 +475,33 @@ static int mwifiex_ret_rf_tx_power(struct mwifiex_private *priv,
 }
 /*
+ * This function handles the command response of set rf antenna
+ */
+static int mwifiex_ret_rf_antenna(struct mwifiex_private *priv,
+                                  struct host_cmd_ds_command *resp)
+{
+        struct host_cmd_ds_rf_ant_mimo *ant_mimo = &resp->params.ant_mimo;
+        struct host_cmd_ds_rf_ant_siso *ant_siso = &resp->params.ant_siso;
+        struct mwifiex_adapter *adapter = priv->adapter;
+        if (adapter->hw_dev_mcs_support == HT_STREAM_2X2)
+                dev_dbg(adapter->dev,
+                        "RF_ANT_RESP: Tx action = 0x%x, Tx Mode = 0x%04x"
+                        " Rx action = 0x%x, Rx Mode = 0x%04x\n",
+                        le16_to_cpu(ant_mimo->action_tx),
+                        le16_to_cpu(ant_mimo->tx_ant_mode),
+                        le16_to_cpu(ant_mimo->action_rx),
+                        le16_to_cpu(ant_mimo->rx_ant_mode));
+        else
+                dev_dbg(adapter->dev,
+                        "RF_ANT_RESP: action = 0x%x, Mode = 0x%04x\n",
+                        le16_to_cpu(ant_siso->action),
+                        le16_to_cpu(ant_siso->ant_mode));
+        return 0;
+}
+/*
 * This function handles the command response of set/get MAC address.
 *
 * Handling includes saving the MAC address in driver.
@@ -868,6 +895,9 @@ int mwifiex_process_sta_cmdresp(struct mwifiex_private *priv, u16 cmdresp_no,
        case HostCmd_CMD_RF_TX_PWR:
                ret = mwifiex_ret_rf_tx_power(priv, resp);
                break;
+        case HostCmd_CMD_RF_ANTENNA:
+                ret = mwifiex_ret_rf_antenna(priv, resp);
+                break;
        case HostCmd_CMD_802_11_PS_MODE_ENH:
                ret = mwifiex_ret_enh_power_mode(priv, resp, data_buf);
                break;
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index 82a1cac920bd..f38786e02623 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -422,11 +422,11 @@ static void p54_rx_frame_sent(struct p54_common *priv, struct sk_buff *skb)
         * Clear manually, ieee80211_tx_info_clear_status would
         * clear the counts too and we need them.
         */
-        memset(&info->status.ampdu_ack_len, 0,
+        memset(&info->status.ack_signal, 0,
               sizeof(struct ieee80211_tx_info) -
-               offsetof(struct ieee80211_tx_info, status.ampdu_ack_len));
+               offsetof(struct ieee80211_tx_info, status.ack_signal));
        BUILD_BUG_ON(offsetof(struct ieee80211_tx_info,
-                              status.ampdu_ack_len) != 23);
+                              status.ack_signal) != 20);
        if (entry_hdr->flags & cpu_to_le16(P54_HDR_FLAG_DATA_ALIGN))
                pad = entry_data->align[0];
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 068276ee8aff..e76f03c9b468 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -1940,10 +1940,8 @@ static void rt2800_config_channel_rf3052(struct rt2x00_dev *rt2x00dev,
        rt2800_rfcsr_write(rt2x00dev, 7, rfcsr);
 }
-#define RT3290_POWER_BOUND     0x27
+#define POWER_BOUND             0x27
-#define RT3290_FREQ_OFFSET_BOUND       0x5f
+#define FREQ_OFFSET_BOUND       0x5f
-#define RT5390_POWER_BOUND     0x27
-#define RT5390_FREQ_OFFSET_BOUND       0x5f
 static void rt2800_config_channel_rf3290(struct rt2x00_dev *rt2x00dev,
                                         struct ieee80211_conf *conf,
@@ -1959,16 +1957,15 @@ static void rt2800_config_channel_rf3290(struct rt2x00_dev *rt2x00dev,
        rt2800_rfcsr_write(rt2x00dev, 11, rfcsr);
        rt2800_rfcsr_read(rt2x00dev, 49, &rfcsr);
-        if (info->default_power1 > RT3290_POWER_BOUND)
+        if (info->default_power1 > POWER_BOUND)
-                rt2x00_set_field8(&rfcsr, RFCSR49_TX, RT3290_POWER_BOUND);
+                rt2x00_set_field8(&rfcsr, RFCSR49_TX, POWER_BOUND);
        else
                rt2x00_set_field8(&rfcsr, RFCSR49_TX, info->default_power1);
        rt2800_rfcsr_write(rt2x00dev, 49, rfcsr);
        rt2800_rfcsr_read(rt2x00dev, 17, &rfcsr);
-        if (rt2x00dev->freq_offset > RT3290_FREQ_OFFSET_BOUND)
+        if (rt2x00dev->freq_offset > FREQ_OFFSET_BOUND)
-                rt2x00_set_field8(&rfcsr, RFCSR17_CODE,
+                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, FREQ_OFFSET_BOUND);
-                                  RT3290_FREQ_OFFSET_BOUND);
        else
                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, rt2x00dev->freq_offset);
        rt2800_rfcsr_write(rt2x00dev, 17, rfcsr);
@@ -2002,17 +1999,16 @@ static void rt2800_config_channel_rf53xx(struct rt2x00_dev *rt2x00dev,
        rt2800_rfcsr_write(rt2x00dev, 11, rfcsr);
        rt2800_rfcsr_read(rt2x00dev, 49, &rfcsr);
-        if (info->default_power1 > RT5390_POWER_BOUND)
+        if (info->default_power1 > POWER_BOUND)
-                rt2x00_set_field8(&rfcsr, RFCSR49_TX, RT5390_POWER_BOUND);
+                rt2x00_set_field8(&rfcsr, RFCSR49_TX, POWER_BOUND);
        else
                rt2x00_set_field8(&rfcsr, RFCSR49_TX, info->default_power1);
        rt2800_rfcsr_write(rt2x00dev, 49, rfcsr);
        if (rt2x00_rt(rt2x00dev, RT5392)) {
                rt2800_rfcsr_read(rt2x00dev, 50, &rfcsr);
-                if (info->default_power1 > RT5390_POWER_BOUND)
+                if (info->default_power1 > POWER_BOUND)
-                        rt2x00_set_field8(&rfcsr, RFCSR50_TX,
+                        rt2x00_set_field8(&rfcsr, RFCSR50_TX, POWER_BOUND);
-                                          RT5390_POWER_BOUND);
                else
                        rt2x00_set_field8(&rfcsr, RFCSR50_TX,
                                          info->default_power2);
@@ -2031,9 +2027,8 @@ static void rt2800_config_channel_rf53xx(struct rt2x00_dev *rt2x00dev,
        rt2800_rfcsr_write(rt2x00dev, 1, rfcsr);
        rt2800_rfcsr_read(rt2x00dev, 17, &rfcsr);
-        if (rt2x00dev->freq_offset > RT5390_FREQ_OFFSET_BOUND)
+        if (rt2x00dev->freq_offset > FREQ_OFFSET_BOUND)
-                rt2x00_set_field8(&rfcsr, RFCSR17_CODE,
+                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, FREQ_OFFSET_BOUND);
-                                  RT5390_FREQ_OFFSET_BOUND);
        else
                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, rt2x00dev->freq_offset);
        rt2800_rfcsr_write(rt2x00dev, 17, rfcsr);
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index dd436125fe3d..235376e9cb04 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -986,7 +986,7 @@ static int rt2800_enable_wlan_rt3290(struct rt2x00_dev *rt2x00dev)
        int i, count;
        rt2800_register_read(rt2x00dev, WLAN_FUN_CTRL, &reg);
-        if ((rt2x00_get_field32(reg, WLAN_EN) == 1))
+        if (rt2x00_get_field32(reg, WLAN_EN))
                return 0;
        rt2x00_set_field32(&reg, WLAN_GPIO_OUT_OE_BIT_ALL, 0xff);
@@ -1004,9 +1004,9 @@ static int rt2800_enable_wlan_rt3290(struct rt2x00_dev *rt2x00dev)
                 */
                for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
                        rt2800_register_read(rt2x00dev, CMB_CTRL, &reg);
-                        if ((rt2x00_get_field32(reg, PLL_LD) == 1) &&
+                        if (rt2x00_get_field32(reg, PLL_LD) &&
-                                (rt2x00_get_field32(reg, XTAL_RDY) == 1))
+                            rt2x00_get_field32(reg, XTAL_RDY))
-                                        break;
+                                break;
                        udelay(REGISTER_BUSY_DELAY);
                }
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 2fd830103415..f7e74a0a7759 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -774,9 +774,7 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
 bool rt2x00queue_for_each_entry(struct data_queue *queue,
                                enum queue_index start,
                                enum queue_index end,
-                                void *data,
+                                bool (*fn)(struct queue_entry *entry))
-                                bool (*fn)(struct queue_entry *entry,
-                                           void *data))
 {
        unsigned long irqflags;
        unsigned int index_start;
@@ -807,17 +805,17 @@ bool rt2x00queue_for_each_entry(struct data_queue *queue,
         */
        if (index_start < index_end) {
                for (i = index_start; i < index_end; i++) {
-                        if (fn(&queue->entries[i], data))
+                        if (fn(&queue->entries[i]))
                                return true;
                }
        } else {
                for (i = index_start; i < queue->limit; i++) {
-                        if (fn(&queue->entries[i], data))
+                        if (fn(&queue->entries[i]))
                                return true;
                }
                for (i = 0; i < index_end; i++) {
-                        if (fn(&queue->entries[i], data))
+                        if (fn(&queue->entries[i]))
                                return true;
                }
        }
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.h b/drivers/net/wireless/rt2x00/rt2x00queue.h
index 5f1392c72673..9b8c10a86dee 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.h
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
@@ -584,7 +584,6 @@ struct data_queue_desc {
 * @queue: Pointer to @data_queue
 * @start: &enum queue_index Pointer to start index
 * @end: &enum queue_index Pointer to end index
- * @data: Data to pass to the callback function
 * @fn: The function to call for each &struct queue_entry
 *
 * This will walk through all entries in the queue, in chronological
@@ -597,9 +596,7 @@ struct data_queue_desc {
 bool rt2x00queue_for_each_entry(struct data_queue *queue,
                                enum queue_index start,
                                enum queue_index end,
-                                void *data,
+                                bool (*fn)(struct queue_entry *entry));
-                                bool (*fn)(struct queue_entry *entry,
-                                           void *data));
 /**
 * rt2x00queue_empty - Check if the queue is empty.
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 74ecc33fdd90..40ea80725a96 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -285,7 +285,7 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
                queue_work(rt2x00dev->workqueue, &rt2x00dev->txdone_work);
 }
-static bool rt2x00usb_kick_tx_entry(struct queue_entry *entry, void* data)
+static bool rt2x00usb_kick_tx_entry(struct queue_entry *entry)
 {
        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
        struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);
@@ -390,7 +390,7 @@ static void rt2x00usb_interrupt_rxdone(struct urb *urb)
        queue_work(rt2x00dev->workqueue, &rt2x00dev->rxdone_work);
 }
-static bool rt2x00usb_kick_rx_entry(struct queue_entry *entry, void* data)
+static bool rt2x00usb_kick_rx_entry(struct queue_entry *entry)
 {
        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
        struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);
@@ -427,18 +427,12 @@ void rt2x00usb_kick_queue(struct data_queue *queue)
        case QID_AC_BE:
        case QID_AC_BK:
                if (!rt2x00queue_empty(queue))
-                        rt2x00queue_for_each_entry(queue,
+                        rt2x00queue_for_each_entry(queue, Q_INDEX_DONE, Q_INDEX,
-                                                   Q_INDEX_DONE,
-                                                   Q_INDEX,
-                                                   NULL,
                                                   rt2x00usb_kick_tx_entry);
                break;
        case QID_RX:
                if (!rt2x00queue_full(queue))
-                        rt2x00queue_for_each_entry(queue,
+                        rt2x00queue_for_each_entry(queue, Q_INDEX, Q_INDEX_DONE,
-                                                   Q_INDEX,
-                                                   Q_INDEX_DONE,
-                                                   NULL,
                                                   rt2x00usb_kick_rx_entry);
                break;
        default:
@@ -447,7 +441,7 @@ void rt2x00usb_kick_queue(struct data_queue *queue)
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_kick_queue);
-static bool rt2x00usb_flush_entry(struct queue_entry *entry, void* data)
+static bool rt2x00usb_flush_entry(struct queue_entry *entry)
 {
        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
        struct queue_entry_priv_usb *entry_priv = entry->priv_data;
@@ -474,7 +468,7 @@ void rt2x00usb_flush_queue(struct data_queue *queue, bool drop)
        unsigned int i;
        if (drop)
-                rt2x00queue_for_each_entry(queue, Q_INDEX_DONE, Q_INDEX, NULL,
+                rt2x00queue_for_each_entry(queue, Q_INDEX_DONE, Q_INDEX,
                                           rt2x00usb_flush_entry);
        /*
@@ -565,7 +559,7 @@ void rt2x00usb_clear_entry(struct queue_entry *entry)
        entry->flags = 0;
        if (entry->queue->qid == QID_RX)
-                rt2x00usb_kick_rx_entry(entry, NULL);
+                rt2x00usb_kick_rx_entry(entry);
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_clear_entry);
diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
index 47ba2e0017f4..3d6c71b7a3c7 100644
--- a/drivers/net/wireless/ti/wl12xx/main.c
+++ b/drivers/net/wireless/ti/wl12xx/main.c
@@ -242,7 +242,7 @@ static struct wlcore_conf wl12xx_conf = {
                .psm_entry_retries           = 8,
                .psm_exit_retries            = 16,
                .psm_entry_nullfunc_retries  = 3,
-                .dynamic_ps_timeout          = 200,
+                .dynamic_ps_timeout          = 1500,
                .forced_ps                   = false,
                .keep_alive_interval         = 55000,
                .max_listen_interval         = 20,
@@ -590,13 +590,13 @@ static const int wl12xx_rtable[REG_TABLE_LEN] = {
 };
 /* TODO: maybe move to a new header file? */
-#define WL127X_FW_NAME_MULTI    "ti-connectivity/wl127x-fw-4-mr.bin"
+#define WL127X_FW_NAME_MULTI    "ti-connectivity/wl127x-fw-5-mr.bin"
-#define WL127X_FW_NAME_SINGLE   "ti-connectivity/wl127x-fw-4-sr.bin"
+#define WL127X_FW_NAME_SINGLE   "ti-connectivity/wl127x-fw-5-sr.bin"
-#define WL127X_PLT_FW_NAME      "ti-connectivity/wl127x-fw-4-plt.bin"
+#define WL127X_PLT_FW_NAME      "ti-connectivity/wl127x-fw-5-plt.bin"
-#define WL128X_FW_NAME_MULTI    "ti-connectivity/wl128x-fw-4-mr.bin"
+#define WL128X_FW_NAME_MULTI    "ti-connectivity/wl128x-fw-5-mr.bin"
-#define WL128X_FW_NAME_SINGLE   "ti-connectivity/wl128x-fw-4-sr.bin"
+#define WL128X_FW_NAME_SINGLE   "ti-connectivity/wl128x-fw-5-sr.bin"
-#define WL128X_PLT_FW_NAME      "ti-connectivity/wl128x-fw-4-plt.bin"
+#define WL128X_PLT_FW_NAME      "ti-connectivity/wl128x-fw-5-plt.bin"
 static int wl127x_prepare_read(struct wl1271 *wl, u32 rx_desc, u32 len)
 {
@@ -637,6 +637,7 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
                               wl->chip.id);
                wl->quirks |= WLCORE_QUIRK_LEGACY_NVS |
+                              WLCORE_QUIRK_DUAL_PROBE_TMPL |
                              WLCORE_QUIRK_TKIP_HEADER_SPACE;
                wl->sr_fw_name = WL127X_FW_NAME_SINGLE;
                wl->mr_fw_name = WL127X_FW_NAME_MULTI;
@@ -646,6 +647,9 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
                /* read data preparation is only needed by wl127x */
                wl->ops->prepare_read = wl127x_prepare_read;
+                wlcore_set_min_fw_ver(wl, WL127X_CHIP_VER, WL127X_IFTYPE_VER,
+                                      WL127X_MAJOR_VER, WL127X_SUBTYPE_VER,
+                                      WL127X_MINOR_VER);
                break;
        case CHIP_ID_1271_PG20:
@@ -653,6 +657,7 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
                             wl->chip.id);
                wl->quirks |= WLCORE_QUIRK_LEGACY_NVS |
+                              WLCORE_QUIRK_DUAL_PROBE_TMPL |
                              WLCORE_QUIRK_TKIP_HEADER_SPACE;
                wl->plt_fw_name = WL127X_PLT_FW_NAME;
                wl->sr_fw_name = WL127X_FW_NAME_SINGLE;
@@ -663,6 +668,9 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
                /* read data preparation is only needed by wl127x */
                wl->ops->prepare_read = wl127x_prepare_read;
+                wlcore_set_min_fw_ver(wl, WL127X_CHIP_VER, WL127X_IFTYPE_VER,
+                                      WL127X_MAJOR_VER, WL127X_SUBTYPE_VER,
+                                      WL127X_MINOR_VER);
                break;
        case CHIP_ID_1283_PG20:
@@ -674,8 +682,12 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
                /* wl128x requires TX blocksize alignment */
                wl->quirks |= WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN |
+                              WLCORE_QUIRK_DUAL_PROBE_TMPL |
                              WLCORE_QUIRK_TKIP_HEADER_SPACE;
+                wlcore_set_min_fw_ver(wl, WL128X_CHIP_VER, WL128X_IFTYPE_VER,
+                                      WL128X_MAJOR_VER, WL128X_SUBTYPE_VER,
+                                      WL128X_MINOR_VER);
                break;
        case CHIP_ID_1283_PG10:
        default:
diff --git a/drivers/net/wireless/ti/wl12xx/wl12xx.h b/drivers/net/wireless/ti/wl12xx/wl12xx.h
index de1132410876..26990fb4edea 100644
--- a/drivers/net/wireless/ti/wl12xx/wl12xx.h
+++ b/drivers/net/wireless/ti/wl12xx/wl12xx.h
@@ -24,6 +24,20 @@
 #include "conf.h"
+/* minimum FW required for driver for wl127x */
+#define WL127X_CHIP_VER         6
+#define WL127X_IFTYPE_VER       3
+#define WL127X_MAJOR_VER        10
+#define WL127X_SUBTYPE_VER      2
+#define WL127X_MINOR_VER        115
+/* minimum FW required for driver for wl128x */
+#define WL128X_CHIP_VER         7
+#define WL128X_IFTYPE_VER       3
+#define WL128X_MAJOR_VER        10
+#define WL128X_SUBTYPE_VER      2
+#define WL128X_MINOR_VER        115
 struct wl127x_rx_mem_pool_addr {
        u32 addr;
        u32 addr_extra;
diff --git a/drivers/net/wireless/ti/wl18xx/main.c b/drivers/net/wireless/ti/wl18xx/main.c
index 5e583be8f674..b378b34c4a6a 100644
--- a/drivers/net/wireless/ti/wl18xx/main.c
+++ b/drivers/net/wireless/ti/wl18xx/main.c
@@ -369,7 +369,7 @@ static struct wlcore_conf wl18xx_conf = {
                .psm_entry_retries           = 8,
                .psm_exit_retries            = 16,
                .psm_entry_nullfunc_retries  = 3,
-                .dynamic_ps_timeout          = 200,
+                .dynamic_ps_timeout          = 1500,
                .forced_ps                   = false,
                .keep_alive_interval         = 55000,
                .max_listen_interval         = 20,
@@ -609,7 +609,12 @@ static int wl18xx_identify_chip(struct wl1271 *wl)
                wl->quirks |= WLCORE_QUIRK_NO_ELP |
                              WLCORE_QUIRK_RX_BLOCKSIZE_ALIGN |
                              WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN |
+                              WLCORE_QUIRK_NO_SCHED_SCAN_WHILE_CONN |
                              WLCORE_QUIRK_TX_PAD_LAST_FRAME;
+                wlcore_set_min_fw_ver(wl, WL18XX_CHIP_VER, WL18XX_IFTYPE_VER,
+                                      WL18XX_MAJOR_VER, WL18XX_SUBTYPE_VER,
+                                      WL18XX_MINOR_VER);
                break;
        case CHIP_ID_185x_PG10:
                wl1271_warning("chip id 0x%x (185x PG10) is deprecated",
@@ -1020,14 +1025,24 @@ static u32 wl18xx_sta_get_ap_rate_mask(struct wl1271 *wl,
 static u32 wl18xx_ap_get_mimo_wide_rate_mask(struct wl1271 *wl,
                                             struct wl12xx_vif *wlvif)
 {
-        if ((wlvif->channel_type == NL80211_CHAN_HT40MINUS ||
+        struct wl18xx_priv *priv = wl->priv;
-             wlvif->channel_type == NL80211_CHAN_HT40PLUS) &&
-            !strcmp(ht_mode_param, "wide")) {
+        if (wlvif->channel_type == NL80211_CHAN_HT40MINUS ||
+            wlvif->channel_type == NL80211_CHAN_HT40PLUS) {
                wl1271_debug(DEBUG_ACX, "using wide channel rate mask");
+                /* sanity check - we don't support this */
+                if (WARN_ON(wlvif->band != IEEE80211_BAND_5GHZ))
+                        return 0;
                return CONF_TX_RATE_USE_WIDE_CHAN;
-        } else if (!strcmp(ht_mode_param, "mimo")) {
+        } else if (priv->conf.phy.number_of_assembled_ant2_4 >= 2 &&
+                   wlvif->band == IEEE80211_BAND_2GHZ) {
                wl1271_debug(DEBUG_ACX, "using MIMO rate mask");
+                /*
+                 * we don't care about HT channel here - if a peer doesn't
+                 * support MIMO, we won't enable it in its rates
+                 */
                return CONF_TX_MIMO_RATES;
        } else {
                return 0;
diff --git a/drivers/net/wireless/ti/wl18xx/wl18xx.h b/drivers/net/wireless/ti/wl18xx/wl18xx.h
index bc67a4750615..6452396fa1d4 100644
--- a/drivers/net/wireless/ti/wl18xx/wl18xx.h
+++ b/drivers/net/wireless/ti/wl18xx/wl18xx.h
@@ -24,6 +24,13 @@
 #include "conf.h"
+/* minimum FW required for driver */
+#define WL18XX_CHIP_VER         8
+#define WL18XX_IFTYPE_VER       2
+#define WL18XX_MAJOR_VER        0
+#define WL18XX_SUBTYPE_VER      0
+#define WL18XX_MINOR_VER        100
 #define WL18XX_CMD_MAX_SIZE          740
 struct wl18xx_priv {
diff --git a/drivers/net/wireless/ti/wlcore/boot.c b/drivers/net/wireless/ti/wlcore/boot.c
index 8965960b841a..375ea574eafb 100644
--- a/drivers/net/wireless/ti/wlcore/boot.c
+++ b/drivers/net/wireless/ti/wlcore/boot.c
@@ -81,6 +81,53 @@ out:
        return ret;
 }
+static int wlcore_validate_fw_ver(struct wl1271 *wl)
+{
+        unsigned int *fw_ver = wl->chip.fw_ver;
+        unsigned int *min_ver = wl->min_fw_ver;
+        /* the chip must be exactly equal */
+        if (min_ver[FW_VER_CHIP] != fw_ver[FW_VER_CHIP])
+                goto fail;
+        /* always check the next digit if all previous ones are equal */
+        if (min_ver[FW_VER_IF_TYPE] < fw_ver[FW_VER_IF_TYPE])
+                goto out;
+        else if (min_ver[FW_VER_IF_TYPE] > fw_ver[FW_VER_IF_TYPE])
+                goto fail;
+        if (min_ver[FW_VER_MAJOR] < fw_ver[FW_VER_MAJOR])
+                goto out;
+        else if (min_ver[FW_VER_MAJOR] > fw_ver[FW_VER_MAJOR])
+                goto fail;
+        if (min_ver[FW_VER_SUBTYPE] < fw_ver[FW_VER_SUBTYPE])
+                goto out;
+        else if (min_ver[FW_VER_SUBTYPE] > fw_ver[FW_VER_SUBTYPE])
+                goto fail;
+        if (min_ver[FW_VER_MINOR] < fw_ver[FW_VER_MINOR])
+                goto out;
+        else if (min_ver[FW_VER_MINOR] > fw_ver[FW_VER_MINOR])
+                goto fail;
+out:
+        return 0;
+fail:
+        wl1271_error("Your WiFi FW version (%u.%u.%u.%u.%u) is outdated.\n"
+                     "Please use at least FW %u.%u.%u.%u.%u.\n"
+                     "You can get more information at:\n"
+                     "http://wireless.kernel.org/en/users/Drivers/wl12xx",
+                     fw_ver[FW_VER_CHIP], fw_ver[FW_VER_IF_TYPE],
+                     fw_ver[FW_VER_MAJOR], fw_ver[FW_VER_SUBTYPE],
+                     fw_ver[FW_VER_MINOR], min_ver[FW_VER_CHIP],
+                     min_ver[FW_VER_IF_TYPE], min_ver[FW_VER_MAJOR],
+                     min_ver[FW_VER_SUBTYPE], min_ver[FW_VER_MINOR]);
+        return -EINVAL;
+}
 static int wlcore_boot_static_data(struct wl1271 *wl)
 {
        struct wl1271_static_data *static_data;
@@ -101,6 +148,10 @@ static int wlcore_boot_static_data(struct wl1271 *wl)
        if (ret < 0)
                goto out_free;
+        ret = wlcore_validate_fw_ver(wl);
+        if (ret < 0)
+                goto out_free;
        ret = wlcore_handle_static_data(wl, static_data);
        if (ret < 0)
                goto out_free;
@@ -141,7 +192,7 @@ static int wl1271_boot_upload_firmware_chunk(struct wl1271 *wl, void *buf,
        partition.mem.start = dest;
        ret = wlcore_set_partition(wl, &partition);
        if (ret < 0)
-                return ret;
+                goto out;
        /* 10.1 set partition limit and chunk num */
        chunk_num = 0;
@@ -157,7 +208,7 @@ static int wl1271_boot_upload_firmware_chunk(struct wl1271 *wl, void *buf,
                        partition.mem.start = addr;
                        ret = wlcore_set_partition(wl, &partition);
                        if (ret < 0)
-                                return ret;
+                                goto out;
                }
                /* 10.3 upload the chunk */
diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index 56c7a2342fdf..a23949cdaebc 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -39,6 +39,7 @@
 #include "hw_ops.h"
 #define WL1271_CMD_FAST_POLL_COUNT       50
+#define WL1271_WAIT_EVENT_FAST_POLL_COUNT 20
 /*
 * send command to firmware
@@ -138,6 +139,7 @@ static int wl1271_cmd_wait_for_event_or_timeout(struct wl1271 *wl,
        u32 *events_vector;
        u32 event;
        unsigned long timeout_time;
+        u16 poll_count = 0;
        int ret = 0;
        *timeout = false;
@@ -156,7 +158,11 @@ static int wl1271_cmd_wait_for_event_or_timeout(struct wl1271 *wl,
                        goto out;
                }
-                msleep(1);
+                poll_count++;
+                if (poll_count < WL1271_WAIT_EVENT_FAST_POLL_COUNT)
+                        usleep_range(50, 51);
+                else
+                        usleep_range(1000, 5000);
                /* read from both event fields */
                ret = wlcore_read(wl, wl->mbox_ptr[0], events_vector,
@@ -1007,12 +1013,14 @@ out:
 int wl12xx_cmd_build_probe_req(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                               u8 role_id, u8 band,
                               const u8 *ssid, size_t ssid_len,
-                               const u8 *ie, size_t ie_len)
+                               const u8 *ie, size_t ie_len, bool sched_scan)
 {
        struct ieee80211_vif *vif = wl12xx_wlvif_to_vif(wlvif);
        struct sk_buff *skb;
        int ret;
        u32 rate;
+        u16 template_id_2_4 = CMD_TEMPL_CFG_PROBE_REQ_2_4;
+        u16 template_id_5 = CMD_TEMPL_CFG_PROBE_REQ_5;
        skb = ieee80211_probereq_get(wl->hw, vif, ssid, ssid_len,
                                     ie, ie_len);
@@ -1023,14 +1031,20 @@ int wl12xx_cmd_build_probe_req(struct wl1271 *wl, struct wl12xx_vif *wlvif,
        wl1271_dump(DEBUG_SCAN, "PROBE REQ: ", skb->data, skb->len);
+        if (!sched_scan &&
+            (wl->quirks & WLCORE_QUIRK_DUAL_PROBE_TMPL)) {
+                template_id_2_4 = CMD_TEMPL_APP_PROBE_REQ_2_4;
+                template_id_5 = CMD_TEMPL_APP_PROBE_REQ_5;
+        }
        rate = wl1271_tx_min_rate_get(wl, wlvif->bitrate_masks[band]);
        if (band == IEEE80211_BAND_2GHZ)
                ret = wl1271_cmd_template_set(wl, role_id,
-                                              CMD_TEMPL_CFG_PROBE_REQ_2_4,
+                                              template_id_2_4,
                                              skb->data, skb->len, 0, rate);
        else
                ret = wl1271_cmd_template_set(wl, role_id,
-                                              CMD_TEMPL_CFG_PROBE_REQ_5,
+                                              template_id_5,
                                              skb->data, skb->len, 0, rate);
 out:
diff --git a/drivers/net/wireless/ti/wlcore/cmd.h b/drivers/net/wireless/ti/wlcore/cmd.h
index c8a6510c72cb..d7d9f801e506 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.h
+++ b/drivers/net/wireless/ti/wlcore/cmd.h
@@ -58,7 +58,7 @@ int wl1271_cmd_build_ps_poll(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 int wl12xx_cmd_build_probe_req(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                               u8 role_id, u8 band,
                               const u8 *ssid, size_t ssid_len,
-                               const u8 *ie, size_t ie_len);
+                               const u8 *ie, size_t ie_len, bool sched_scan);
 struct sk_buff *wl1271_cmd_build_ap_probe_req(struct wl1271 *wl,
                                              struct wl12xx_vif *wlvif,
                                              struct sk_buff *skb);
@@ -172,8 +172,8 @@ enum cmd_templ {
        CMD_TEMPL_PS_POLL,
        CMD_TEMPL_KLV,
        CMD_TEMPL_DISCONNECT,
-        CMD_TEMPL_PROBE_REQ_2_4, /* for firmware internal use only */
+        CMD_TEMPL_APP_PROBE_REQ_2_4,
-        CMD_TEMPL_PROBE_REQ_5,   /* for firmware internal use only */
+        CMD_TEMPL_APP_PROBE_REQ_5,
        CMD_TEMPL_BAR,           /* for firmware internal use only */
        CMD_TEMPL_CTS,           /*
                                  * For CTS-to-self (FastCTS) mechanism
diff --git a/drivers/net/wireless/ti/wlcore/init.c b/drivers/net/wireless/ti/wlcore/init.c
index 8a8a8971befa..a3c867786df8 100644
--- a/drivers/net/wireless/ti/wlcore/init.c
+++ b/drivers/net/wireless/ti/wlcore/init.c
@@ -54,6 +54,22 @@ int wl1271_init_templates_config(struct wl1271 *wl)
        if (ret < 0)
                return ret;
+        if (wl->quirks & WLCORE_QUIRK_DUAL_PROBE_TMPL) {
+                ret = wl1271_cmd_template_set(wl, WL12XX_INVALID_ROLE_ID,
+                                              CMD_TEMPL_APP_PROBE_REQ_2_4, NULL,
+                                              WL1271_CMD_TEMPL_MAX_SIZE,
+                                              0, WL1271_RATE_AUTOMATIC);
+                if (ret < 0)
+                        return ret;
+                ret = wl1271_cmd_template_set(wl, WL12XX_INVALID_ROLE_ID,
+                                              CMD_TEMPL_APP_PROBE_REQ_5, NULL,
+                                              WL1271_CMD_TEMPL_MAX_SIZE,
+                                              0, WL1271_RATE_AUTOMATIC);
+                if (ret < 0)
+                        return ret;
+        }
        ret = wl1271_cmd_template_set(wl, WL12XX_INVALID_ROLE_ID,
                                      CMD_TEMPL_NULL_DATA, NULL,
                                      sizeof(struct wl12xx_null_data_template),
diff --git a/drivers/net/wireless/ti/wlcore/io.c b/drivers/net/wireless/ti/wlcore/io.c
index 9976219c4e49..68e74eefd296 100644
--- a/drivers/net/wireless/ti/wlcore/io.c
+++ b/drivers/net/wireless/ti/wlcore/io.c
@@ -60,6 +60,12 @@ void wlcore_enable_interrupts(struct wl1271 *wl)
 }
 EXPORT_SYMBOL_GPL(wlcore_enable_interrupts);
+void wlcore_synchronize_interrupts(struct wl1271 *wl)
+{
+        synchronize_irq(wl->irq);
+}
+EXPORT_SYMBOL_GPL(wlcore_synchronize_interrupts);
 int wlcore_translate_addr(struct wl1271 *wl, int addr)
 {
        struct wlcore_partition_set *part = &wl->curr_part;
diff --git a/drivers/net/wireless/ti/wlcore/io.h b/drivers/net/wireless/ti/wlcore/io.h
index fef80adc8bf5..259149f36fae 100644
--- a/drivers/net/wireless/ti/wlcore/io.h
+++ b/drivers/net/wireless/ti/wlcore/io.h
@@ -47,6 +47,7 @@ struct wl1271;
 void wlcore_disable_interrupts(struct wl1271 *wl);
 void wlcore_disable_interrupts_nosync(struct wl1271 *wl);
 void wlcore_enable_interrupts(struct wl1271 *wl);
+void wlcore_synchronize_interrupts(struct wl1271 *wl);
 void wl1271_io_reset(struct wl1271 *wl);
 void wl1271_io_init(struct wl1271 *wl);
@@ -59,12 +60,12 @@ static inline int __must_check wlcore_raw_write(struct wl1271 *wl, int addr,
 {
        int ret;
-        if (test_bit(WL1271_FLAG_SDIO_FAILED, &wl->flags))
+        if (test_bit(WL1271_FLAG_IO_FAILED, &wl->flags))
                return -EIO;
        ret = wl->if_ops->write(wl->dev, addr, buf, len, fixed);
-        if (ret)
+        if (ret && wl->state != WL1271_STATE_OFF)
-                set_bit(WL1271_FLAG_SDIO_FAILED, &wl->flags);
+                set_bit(WL1271_FLAG_IO_FAILED, &wl->flags);
        return ret;
 }
@@ -75,12 +76,12 @@ static inline int __must_check wlcore_raw_read(struct wl1271 *wl, int addr,
 {
        int ret;
-        if (test_bit(WL1271_FLAG_SDIO_FAILED, &wl->flags))
+        if (test_bit(WL1271_FLAG_IO_FAILED, &wl->flags))
                return -EIO;
        ret = wl->if_ops->read(wl->dev, addr, buf, len, fixed);
-        if (ret)
+        if (ret && wl->state != WL1271_STATE_OFF)
-                set_bit(WL1271_FLAG_SDIO_FAILED, &wl->flags);
+                set_bit(WL1271_FLAG_IO_FAILED, &wl->flags);
        return ret;
 }
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 2240cca597ac..9f04b64dfa33 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -62,7 +62,7 @@ static bool no_recovery;
 static void __wl1271_op_remove_interface(struct wl1271 *wl,
                                         struct ieee80211_vif *vif,
                                         bool reset_tx_queues);
-static void wl1271_op_stop(struct ieee80211_hw *hw);
+static void wlcore_op_stop_locked(struct wl1271 *wl);
 static void wl1271_free_ap_keys(struct wl1271 *wl, struct wl12xx_vif *wlvif);
 static int wl12xx_set_authorized(struct wl1271 *wl,
@@ -916,16 +916,16 @@ static void wl1271_recovery_work(struct work_struct *work)
        if (wl->state != WL1271_STATE_ON || wl->plt)
                goto out_unlock;
-        wl12xx_read_fwlog_panic(wl);
+        if (!test_bit(WL1271_FLAG_INTENDED_FW_RECOVERY, &wl->flags)) {
+                wl12xx_read_fwlog_panic(wl);
-        wlcore_print_recovery(wl);
+                wlcore_print_recovery(wl);
+        }
        BUG_ON(bug_on_recovery &&
               !test_bit(WL1271_FLAG_INTENDED_FW_RECOVERY, &wl->flags));
        if (no_recovery) {
                wl1271_info("No recovery (chosen on module load). Fw will remain stuck.");
-                clear_bit(WL1271_FLAG_RECOVERY_IN_PROGRESS, &wl->flags);
                goto out_unlock;
        }
@@ -956,9 +956,8 @@ static void wl1271_recovery_work(struct work_struct *work)
                vif = wl12xx_wlvif_to_vif(wlvif);
                __wl1271_op_remove_interface(wl, vif, false);
        }
-        wl->watchdog_recovery = false;
-        mutex_unlock(&wl->mutex);
+        wlcore_op_stop_locked(wl);
-        wl1271_op_stop(wl->hw);
        ieee80211_restart_hw(wl->hw);
@@ -967,9 +966,10 @@ static void wl1271_recovery_work(struct work_struct *work)
         * to restart the HW.
         */
        wlcore_wake_queues(wl, WLCORE_QUEUE_STOP_REASON_FW_RESTART);
-        return;
 out_unlock:
-        wl->watchdog_recovery = false;
+        wl->watchdog_recovery = false;
+        clear_bit(WL1271_FLAG_RECOVERY_IN_PROGRESS, &wl->flags);
        mutex_unlock(&wl->mutex);
 }
@@ -1211,7 +1211,9 @@ static void wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         * The workqueue is slow to process the tx_queue and we need stop
         * the queue here, otherwise the queue will get too long.
         */
-        if (wl->tx_queue_count[q] >= WL1271_TX_QUEUE_HIGH_WATERMARK) {
+        if (wl->tx_queue_count[q] >= WL1271_TX_QUEUE_HIGH_WATERMARK &&
+            !wlcore_is_queue_stopped_by_reason(wl, q,
+                                        WLCORE_QUEUE_STOP_REASON_WATERMARK)) {
                wl1271_debug(DEBUG_TX, "op_tx: stopping queues for q %d", q);
                wlcore_stop_queue_locked(wl, q,
                                         WLCORE_QUEUE_STOP_REASON_WATERMARK);
@@ -1797,33 +1799,15 @@ static int wl1271_op_start(struct ieee80211_hw *hw)
        return 0;
 }
-static void wl1271_op_stop(struct ieee80211_hw *hw)
+static void wlcore_op_stop_locked(struct wl1271 *wl)
 {
-        struct wl1271 *wl = hw->priv;
        int i;
-        wl1271_debug(DEBUG_MAC80211, "mac80211 stop");
-        /*
-         * Interrupts must be disabled before setting the state to OFF.
-         * Otherwise, the interrupt handler might be called and exit without
-         * reading the interrupt status.
-         */
-        wlcore_disable_interrupts(wl);
-        mutex_lock(&wl->mutex);
        if (wl->state == WL1271_STATE_OFF) {
                if (test_and_clear_bit(WL1271_FLAG_RECOVERY_IN_PROGRESS,
                                        &wl->flags))
                        wlcore_enable_interrupts(wl);
-                mutex_unlock(&wl->mutex);
-                /*
-                 * This will not necessarily enable interrupts as interrupts
-                 * may have been disabled when op_stop was called. It will,
-                 * however, balance the above call to disable_interrupts().
-                 */
-                wlcore_enable_interrupts(wl);
                return;
        }
@@ -1832,8 +1816,16 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
         * functions don't perform further work.
         */
        wl->state = WL1271_STATE_OFF;
+        /*
+         * Use the nosync variant to disable interrupts, so the mutex could be
+         * held while doing so without deadlocking.
+         */
+        wlcore_disable_interrupts_nosync(wl);
        mutex_unlock(&wl->mutex);
+        wlcore_synchronize_interrupts(wl);
        wl1271_flush_deferred_work(wl);
        cancel_delayed_work_sync(&wl->scan_complete_work);
        cancel_work_sync(&wl->netstack_work);
@@ -1900,6 +1892,17 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
        wl->tx_res_if = NULL;
        kfree(wl->target_mem_map);
        wl->target_mem_map = NULL;
+}
+static void wlcore_op_stop(struct ieee80211_hw *hw)
+{
+        struct wl1271 *wl = hw->priv;
+        wl1271_debug(DEBUG_MAC80211, "mac80211 stop");
+        mutex_lock(&wl->mutex);
+        wlcore_op_stop_locked(wl);
        mutex_unlock(&wl->mutex);
 }
@@ -4566,7 +4569,7 @@ static int wl12xx_set_bitrate_mask(struct ieee80211_hw *hw,
        mutex_lock(&wl->mutex);
-        for (i = 0; i < IEEE80211_NUM_BANDS; i++)
+        for (i = 0; i < WLCORE_NUM_BANDS; i++)
                wlvif->bitrate_masks[i] =
                        wl1271_tx_enabled_rates_get(wl,
                                                    mask->control[i].legacy,
@@ -4634,6 +4637,13 @@ out:
        mutex_unlock(&wl->mutex);
 }
+static void wlcore_op_flush(struct ieee80211_hw *hw, bool drop)
+{
+        struct wl1271 *wl = hw->priv;
+        wl1271_tx_flush(wl);
+}
 static bool wl1271_tx_frames_pending(struct ieee80211_hw *hw)
 {
        struct wl1271 *wl = hw->priv;
@@ -4796,7 +4806,7 @@ static struct ieee80211_supported_band wl1271_band_5ghz = {
 static const struct ieee80211_ops wl1271_ops = {
        .start = wl1271_op_start,
-        .stop = wl1271_op_stop,
+        .stop = wlcore_op_stop,
        .add_interface = wl1271_op_add_interface,
        .remove_interface = wl1271_op_remove_interface,
        .change_interface = wl12xx_op_change_interface,
@@ -4824,6 +4834,7 @@ static const struct ieee80211_ops wl1271_ops = {
        .tx_frames_pending = wl1271_tx_frames_pending,
        .set_bitrate_mask = wl12xx_set_bitrate_mask,
        .channel_switch = wl12xx_op_channel_switch,
+        .flush = wlcore_op_flush,
        CFG80211_TESTMODE_CMD(wl1271_tm_cmd)
 };
@@ -5504,6 +5515,7 @@ int __devinit wlcore_probe(struct wl1271 *wl, struct platform_device *pdev)
                goto out_free_hw;
        }
+#ifdef CONFIG_PM
        ret = enable_irq_wake(wl->irq);
        if (!ret) {
                wl->irq_wake_enabled = true;
@@ -5517,6 +5529,7 @@ int __devinit wlcore_probe(struct wl1271 *wl, struct platform_device *pdev)
                                WL1271_RX_FILTER_MAX_PATTERN_SIZE;
                }
        }
+#endif
        disable_irq(wl->irq);
        ret = wl12xx_get_hw_info(wl);
diff --git a/drivers/net/wireless/ti/wlcore/scan.c b/drivers/net/wireless/ti/wlcore/scan.c
index d9daed53ceb7..dbeca1bfbb2c 100644
--- a/drivers/net/wireless/ti/wlcore/scan.c
+++ b/drivers/net/wireless/ti/wlcore/scan.c
@@ -226,7 +226,7 @@ static int wl1271_scan_send(struct wl1271 *wl, struct ieee80211_vif *vif,
                                         cmd->params.role_id, band,
                                         wl->scan.ssid, wl->scan.ssid_len,
                                         wl->scan.req->ie,
-                                         wl->scan.req->ie_len);
+                                         wl->scan.req->ie_len, false);
        if (ret < 0) {
                wl1271_error("PROBE request template failed");
                goto out;
@@ -633,7 +633,7 @@ wl12xx_scan_sched_scan_ssid_list(struct wl1271 *wl,
                                for (j = 0; j < cmd->n_ssids; j++)
                                        if ((req->ssids[i].ssid_len ==
-                                             req->ssids[j].ssid_len) &&
+                                             cmd->ssids[j].len) &&
                                            !memcmp(req->ssids[i].ssid,
                                                   cmd->ssids[j].ssid,
                                                   req->ssids[i].ssid_len)) {
@@ -722,7 +722,7 @@ int wl1271_scan_sched_scan_config(struct wl1271 *wl,
                                                 req->ssids[0].ssid,
                                                 req->ssids[0].ssid_len,
                                                 ies->ie[band],
-                                                 ies->len[band]);
+                                                 ies->len[band], true);
                if (ret < 0) {
                        wl1271_error("2.4GHz PROBE request template failed");
                        goto out;
@@ -736,7 +736,7 @@ int wl1271_scan_sched_scan_config(struct wl1271 *wl,
                                                 req->ssids[0].ssid,
                                                 req->ssids[0].ssid_len,
                                                 ies->ie[band],
-                                                 ies->len[band]);
+                                                 ies->len[band], true);
                if (ret < 0) {
                        wl1271_error("5GHz PROBE request template failed");
                        goto out;
@@ -766,7 +766,8 @@ int wl1271_scan_sched_scan_start(struct wl1271 *wl, struct wl12xx_vif *wlvif)
        if (wlvif->bss_type != BSS_TYPE_STA_BSS)
                return -EOPNOTSUPP;
-        if (test_bit(WLVIF_FLAG_IN_USE, &wlvif->flags))
+        if ((wl->quirks & WLCORE_QUIRK_NO_SCHED_SCAN_WHILE_CONN) &&
+            test_bit(WLVIF_FLAG_IN_USE, &wlvif->flags))
                return -EBUSY;
        start = kzalloc(sizeof(*start), GFP_KERNEL);
diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c
index 204e69fa9327..73ace4b2604e 100644
--- a/drivers/net/wireless/ti/wlcore/sdio.c
+++ b/drivers/net/wireless/ti/wlcore/sdio.c
@@ -411,9 +411,3 @@ MODULE_PARM_DESC(dump, "Enable sdio read/write dumps.");
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Luciano Coelho <coelho@ti.com>");
 MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
-MODULE_FIRMWARE(WL127X_FW_NAME_SINGLE);
-MODULE_FIRMWARE(WL127X_FW_NAME_MULTI);
-MODULE_FIRMWARE(WL127X_PLT_FW_NAME);
-MODULE_FIRMWARE(WL128X_FW_NAME_SINGLE);
-MODULE_FIRMWARE(WL128X_FW_NAME_MULTI);
-MODULE_FIRMWARE(WL128X_PLT_FW_NAME);
diff --git a/drivers/net/wireless/ti/wlcore/spi.c b/drivers/net/wireless/ti/wlcore/spi.c
index 6420abae40ee..8da4ed243ebc 100644
--- a/drivers/net/wireless/ti/wlcore/spi.c
+++ b/drivers/net/wireless/ti/wlcore/spi.c
@@ -435,10 +435,4 @@ module_exit(wl1271_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Luciano Coelho <coelho@ti.com>");
 MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
-MODULE_FIRMWARE(WL127X_FW_NAME_SINGLE);
-MODULE_FIRMWARE(WL127X_FW_NAME_MULTI);
-MODULE_FIRMWARE(WL127X_PLT_FW_NAME);
-MODULE_FIRMWARE(WL128X_FW_NAME_SINGLE);
-MODULE_FIRMWARE(WL128X_FW_NAME_MULTI);
-MODULE_FIRMWARE(WL128X_PLT_FW_NAME);
 MODULE_ALIAS("spi:wl1271");
diff --git a/drivers/net/wireless/ti/wlcore/testmode.c b/drivers/net/wireless/ti/wlcore/testmode.c
index eeb339d61d1e..d6f57e2c03cf 100644
--- a/drivers/net/wireless/ti/wlcore/testmode.c
+++ b/drivers/net/wireless/ti/wlcore/testmode.c
@@ -40,7 +40,7 @@ enum wl1271_tm_commands {
        WL1271_TM_CMD_CONFIGURE,
        WL1271_TM_CMD_NVS_PUSH,         /* Not in use. Keep to not break ABI */
        WL1271_TM_CMD_SET_PLT_MODE,
-        WL1271_TM_CMD_RECOVER,
+        WL1271_TM_CMD_RECOVER,          /* Not in use. Keep to not break ABI */
        WL1271_TM_CMD_GET_MAC,
        __WL1271_TM_CMD_AFTER_LAST
@@ -272,15 +272,6 @@ static int wl1271_tm_cmd_set_plt_mode(struct wl1271 *wl, struct nlattr *tb[])
        return ret;
 }
-static int wl1271_tm_cmd_recover(struct wl1271 *wl, struct nlattr *tb[])
-{
-        wl1271_debug(DEBUG_TESTMODE, "testmode cmd recover");
-        wl12xx_queue_recovery_work(wl);
-        return 0;
-}
 static int wl12xx_tm_cmd_get_mac(struct wl1271 *wl, struct nlattr *tb[])
 {
        struct sk_buff *skb;
@@ -350,8 +341,6 @@ int wl1271_tm_cmd(struct ieee80211_hw *hw, void *data, int len)
                return wl1271_tm_cmd_configure(wl, tb);
        case WL1271_TM_CMD_SET_PLT_MODE:
                return wl1271_tm_cmd_set_plt_mode(wl, tb);
-        case WL1271_TM_CMD_RECOVER:
-                return wl1271_tm_cmd_recover(wl, tb);
        case WL1271_TM_CMD_GET_MAC:
                return wl12xx_tm_cmd_get_mac(wl, tb);
        default:
diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
index e796974df59b..27ccc275a1c1 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore.h
@@ -304,7 +304,7 @@ struct wl1271 {
        s8 noise;
        /* bands supported by this instance of wl12xx */
-        struct ieee80211_supported_band bands[IEEE80211_NUM_BANDS];
+        struct ieee80211_supported_band bands[WLCORE_NUM_BANDS];
        /*
         * wowlan trigger was configured during suspend.
@@ -371,7 +371,7 @@ struct wl1271 {
        u8 hw_min_ht_rate;
        /* HW HT (11n) capabilities */
-        struct ieee80211_sta_ht_cap ht_cap[IEEE80211_NUM_BANDS];
+        struct ieee80211_sta_ht_cap ht_cap[WLCORE_NUM_BANDS];
        /* size of the private FW status data */
        size_t fw_status_priv_len;
@@ -390,6 +390,9 @@ struct wl1271 {
        /* sleep auth value currently configured to FW */
        int sleep_auth;
+        /* the minimum FW version required for the driver to work */
+        unsigned int min_fw_ver[NUM_FW_VER];
 };
 int __devinit wlcore_probe(struct wl1271 *wl, struct platform_device *pdev);
@@ -408,6 +411,18 @@ wlcore_set_ht_cap(struct wl1271 *wl, enum ieee80211_band band,
        memcpy(&wl->ht_cap[band], ht_cap, sizeof(*ht_cap));
 }
+static inline void
+wlcore_set_min_fw_ver(struct wl1271 *wl, unsigned int chip,
+                      unsigned int iftype, unsigned int major,
+                      unsigned int subtype, unsigned int minor)
+{
+        wl->min_fw_ver[FW_VER_CHIP] = chip;
+        wl->min_fw_ver[FW_VER_IF_TYPE] = iftype;
+        wl->min_fw_ver[FW_VER_MAJOR] = major;
+        wl->min_fw_ver[FW_VER_SUBTYPE] = subtype;
+        wl->min_fw_ver[FW_VER_MINOR] = minor;
+}
 /* Firmware image load chunk size */
 #define CHUNK_SIZE      16384
@@ -437,6 +452,12 @@ wlcore_set_ht_cap(struct wl1271 *wl, enum ieee80211_band band,
 /* extra header space is required for TKIP */
 #define WLCORE_QUIRK_TKIP_HEADER_SPACE          BIT(8)
+/* Some firmwares not support sched scans while connected */
+#define WLCORE_QUIRK_NO_SCHED_SCAN_WHILE_CONN   BIT(9)
+/* separate probe response templates for one-shot and sched scans */
+#define WLCORE_QUIRK_DUAL_PROBE_TMPL            BIT(10)
 /* TODO: move to the lower drivers when all usages are abstracted */
 #define CHIP_ID_1271_PG10              (0x4030101)
 #define CHIP_ID_1271_PG20              (0x4030111)
diff --git a/drivers/net/wireless/ti/wlcore/wlcore_i.h b/drivers/net/wireless/ti/wlcore/wlcore_i.h
index 4273a21cdde1..0187eef4fb07 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore_i.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore_i.h
@@ -35,15 +35,6 @@
 #include "conf.h"
 #include "ini.h"
-#define WL127X_FW_NAME_MULTI "ti-connectivity/wl127x-fw-4-mr.bin"
-#define WL127X_FW_NAME_SINGLE "ti-connectivity/wl127x-fw-4-sr.bin"
-#define WL128X_FW_NAME_MULTI "ti-connectivity/wl128x-fw-4-mr.bin"
-#define WL128X_FW_NAME_SINGLE "ti-connectivity/wl128x-fw-4-sr.bin"
-#define WL127X_PLT_FW_NAME "ti-connectivity/wl127x-fw-4-plt.bin"
-#define WL128X_PLT_FW_NAME "ti-connectivity/wl128x-fw-4-plt.bin"
 /*
 * wl127x and wl128x are using the same NVS file name. However, the
 * ini parameters between them are different.  The driver validates
@@ -71,6 +62,9 @@
 #define WL12XX_INVALID_ROLE_ID     0xff
 #define WL12XX_INVALID_LINK_ID     0xff
+/* the driver supports the 2.4Ghz and 5Ghz bands */
+#define WLCORE_NUM_BANDS           2
 #define WL12XX_MAX_RATE_POLICIES 16
 /* Defined by FW as 0. Will not be freed or allocated. */
@@ -247,7 +241,7 @@ enum wl12xx_flags {
        WL1271_FLAG_RECOVERY_IN_PROGRESS,
        WL1271_FLAG_VIF_CHANGE_IN_PROGRESS,
        WL1271_FLAG_INTENDED_FW_RECOVERY,
-        WL1271_FLAG_SDIO_FAILED,
+        WL1271_FLAG_IO_FAILED,
 };
 enum wl12xx_vif_flags {
@@ -369,7 +363,7 @@ struct wl12xx_vif {
        int channel;
        enum nl80211_channel_type channel_type;
-        u32 bitrate_masks[IEEE80211_NUM_BANDS];
+        u32 bitrate_masks[WLCORE_NUM_BANDS];
        u32 basic_rate_set;
        /*
diff --git a/drivers/nfc/nfcwilink.c b/drivers/nfc/nfcwilink.c
index 1f74a77d040d..e7fd4938f9bc 100644
--- a/drivers/nfc/nfcwilink.c
+++ b/drivers/nfc/nfcwilink.c
@@ -535,9 +535,10 @@ static int nfcwilink_probe(struct platform_device *pdev)
        drv->pdev = pdev;
        protocols = NFC_PROTO_JEWEL_MASK
-                        | NFC_PROTO_MIFARE_MASK | NFC_PROTO_FELICA_MASK
+                | NFC_PROTO_MIFARE_MASK | NFC_PROTO_FELICA_MASK
-                        | NFC_PROTO_ISO14443_MASK
+                | NFC_PROTO_ISO14443_MASK
-                        | NFC_PROTO_NFC_DEP_MASK;
+                | NFC_PROTO_ISO14443_B_MASK
+                | NFC_PROTO_NFC_DEP_MASK;
        drv->ndev = nci_allocate_device(&nfcwilink_ops,
                                        protocols,
diff --git a/drivers/nfc/pn533.c b/drivers/nfc/pn533.c
index 9ac829e22e73..d606f52fec84 100644
--- a/drivers/nfc/pn533.c
+++ b/drivers/nfc/pn533.c
@@ -38,9 +38,44 @@
 #define SCM_VENDOR_ID 0x4E6
 #define SCL3711_PRODUCT_ID 0x5591
+#define SONY_VENDOR_ID         0x054c
+#define PASORI_PRODUCT_ID      0x02e1
+#define PN533_QUIRKS_TYPE_A          BIT(0)
+#define PN533_QUIRKS_TYPE_F          BIT(1)
+#define PN533_QUIRKS_DEP             BIT(2)
+#define PN533_QUIRKS_RAW_EXCHANGE    BIT(3)
+#define PN533_DEVICE_STD    0x1
+#define PN533_DEVICE_PASORI 0x2
+#define PN533_ALL_PROTOCOLS (NFC_PROTO_JEWEL_MASK | NFC_PROTO_MIFARE_MASK |\
+                             NFC_PROTO_FELICA_MASK | NFC_PROTO_ISO14443_MASK |\
+                             NFC_PROTO_NFC_DEP_MASK |\
+                             NFC_PROTO_ISO14443_B_MASK)
+#define PN533_NO_TYPE_B_PROTOCOLS (NFC_PROTO_JEWEL_MASK | \
+                                   NFC_PROTO_MIFARE_MASK | \
+                                   NFC_PROTO_FELICA_MASK | \
+                                   NFC_PROTO_ISO14443_MASK | \
+                                   NFC_PROTO_NFC_DEP_MASK)
 static const struct usb_device_id pn533_table[] = {
-        { USB_DEVICE(PN533_VENDOR_ID, PN533_PRODUCT_ID) },
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
-        { USB_DEVICE(SCM_VENDOR_ID, SCL3711_PRODUCT_ID) },
+          .idVendor             = PN533_VENDOR_ID,
+          .idProduct            = PN533_PRODUCT_ID,
+          .driver_info          = PN533_DEVICE_STD,
+        },
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
+          .idVendor             = SCM_VENDOR_ID,
+          .idProduct            = SCL3711_PRODUCT_ID,
+          .driver_info          = PN533_DEVICE_STD,
+        },
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
+          .idVendor             = SONY_VENDOR_ID,
+          .idProduct            = PASORI_PRODUCT_ID,
+          .driver_info          = PN533_DEVICE_PASORI,
+        },
        { }
 };
 MODULE_DEVICE_TABLE(usb, pn533_table);
@@ -72,6 +107,7 @@ MODULE_DEVICE_TABLE(usb, pn533_table);
 #define PN533_CMD_GET_FIRMWARE_VERSION 0x02
 #define PN533_CMD_RF_CONFIGURATION 0x32
 #define PN533_CMD_IN_DATA_EXCHANGE 0x40
+#define PN533_CMD_IN_COMM_THRU     0x42
 #define PN533_CMD_IN_LIST_PASSIVE_TARGET 0x4A
 #define PN533_CMD_IN_ATR 0x50
 #define PN533_CMD_IN_RELEASE 0x52
@@ -109,6 +145,7 @@ struct pn533_fw_version {
 /* PN533_CMD_RF_CONFIGURATION */
 #define PN533_CFGITEM_TIMING 0x02
 #define PN533_CFGITEM_MAX_RETRIES 0x05
+#define PN533_CFGITEM_PASORI 0x82
 #define PN533_CONFIG_TIMING_102 0xb
 #define PN533_CONFIG_TIMING_204 0xc
@@ -344,6 +381,8 @@ struct pn533 {
        u8 tgt_available_prots;
        u8 tgt_active_prot;
        u8 tgt_mode;
+        u32 device_type;
 };
 struct pn533_frame {
@@ -950,7 +989,7 @@ static int pn533_target_found_type_b(struct nfc_target *nfc_tgt, u8 *tgt_data,
        if (!pn533_target_type_b_is_valid(tgt_type_b, tgt_data_len))
                return -EPROTO;
-        nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK;
+        nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_B_MASK;
        return 0;
 }
@@ -1057,7 +1096,7 @@ static void pn533_poll_create_mod_list(struct pn533 *dev,
        if (im_protocols & NFC_PROTO_JEWEL_MASK)
                pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_JEWEL);
-        if (im_protocols & NFC_PROTO_ISO14443_MASK)
+        if (im_protocols & NFC_PROTO_ISO14443_B_MASK)
                pn533_poll_add_mod(dev, PN533_POLL_MOD_847KBPS_B);
        if (tm_protocols)
@@ -1768,13 +1807,30 @@ static int pn533_build_tx_frame(struct pn533 *dev, struct sk_buff *skb,
        }
        if (target == true) {
-                skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN);
+                switch (dev->device_type) {
-                out_frame = (struct pn533_frame *) skb->data;
+                case PN533_DEVICE_PASORI:
+                        if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
+                                skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN - 1);
+                                out_frame = (struct pn533_frame *) skb->data;
+                                pn533_tx_frame_init(out_frame,
+                                                    PN533_CMD_IN_COMM_THRU);
+                                break;
+                        }
+                default:
+                        skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN);
+                        out_frame = (struct pn533_frame *) skb->data;
+                        pn533_tx_frame_init(out_frame,
+                                            PN533_CMD_IN_DATA_EXCHANGE);
+                        tg = 1;
+                        memcpy(PN533_FRAME_CMD_PARAMS_PTR(out_frame),
+                               &tg, sizeof(u8));
+                        out_frame->datalen += sizeof(u8);
+                        break;
+                }
-                pn533_tx_frame_init(out_frame, PN533_CMD_IN_DATA_EXCHANGE);
-                tg = 1;
-                memcpy(PN533_FRAME_CMD_PARAMS_PTR(out_frame), &tg, sizeof(u8));
-                out_frame->datalen += sizeof(u8);
        } else {
                skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN - 1);
                out_frame = (struct pn533_frame *) skb->data;
@@ -2101,7 +2157,28 @@ static int pn533_set_configuration(struct pn533 *dev, u8 cfgitem, u8 *cfgdata,
        return rc;
 }
-struct nfc_ops pn533_nfc_ops = {
+static int pn533_fw_reset(struct pn533 *dev)
+{
+        int rc;
+        u8 *params;
+        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
+        pn533_tx_frame_init(dev->out_frame, 0x18);
+        params = PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame);
+        params[0] = 0x1;
+        dev->out_frame->datalen += 1;
+        pn533_tx_frame_finish(dev->out_frame);
+        rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
+                                       dev->in_maxlen);
+        return rc;
+}
+static struct nfc_ops pn533_nfc_ops = {
        .dev_up = NULL,
        .dev_down = NULL,
        .dep_link_up = pn533_dep_link_up,
@@ -2114,6 +2191,84 @@ struct nfc_ops pn533_nfc_ops = {
        .tm_send = pn533_tm_send,
 };
+static int pn533_setup(struct pn533 *dev)
+{
+        struct pn533_config_max_retries max_retries;
+        struct pn533_config_timing timing;
+        u8 pasori_cfg[3] = {0x08, 0x01, 0x08};
+        int rc;
+        switch (dev->device_type) {
+        case PN533_DEVICE_STD:
+                max_retries.mx_rty_atr = PN533_CONFIG_MAX_RETRIES_ENDLESS;
+                max_retries.mx_rty_psl = 2;
+                max_retries.mx_rty_passive_act =
+                        PN533_CONFIG_MAX_RETRIES_NO_RETRY;
+                timing.rfu = PN533_CONFIG_TIMING_102;
+                timing.atr_res_timeout = PN533_CONFIG_TIMING_204;
+                timing.dep_timeout = PN533_CONFIG_TIMING_409;
+                break;
+        case PN533_DEVICE_PASORI:
+                max_retries.mx_rty_atr = 0x2;
+                max_retries.mx_rty_psl = 0x1;
+                max_retries.mx_rty_passive_act =
+                        PN533_CONFIG_MAX_RETRIES_NO_RETRY;
+                timing.rfu = PN533_CONFIG_TIMING_102;
+                timing.atr_res_timeout = PN533_CONFIG_TIMING_102;
+                timing.dep_timeout = PN533_CONFIG_TIMING_204;
+                break;
+        default:
+                nfc_dev_err(&dev->interface->dev, "Unknown device type %d\n",
+                            dev->device_type);
+                return -EINVAL;
+        }
+        rc = pn533_set_configuration(dev, PN533_CFGITEM_MAX_RETRIES,
+                                     (u8 *)&max_retries, sizeof(max_retries));
+        if (rc) {
+                nfc_dev_err(&dev->interface->dev,
+                            "Error on setting MAX_RETRIES config");
+                return rc;
+        }
+        rc = pn533_set_configuration(dev, PN533_CFGITEM_TIMING,
+                                     (u8 *)&timing, sizeof(timing));
+        if (rc) {
+                nfc_dev_err(&dev->interface->dev,
+                            "Error on setting RF timings");
+                return rc;
+        }
+        switch (dev->device_type) {
+        case PN533_DEVICE_STD:
+                break;
+        case PN533_DEVICE_PASORI:
+                pn533_fw_reset(dev);
+                rc = pn533_set_configuration(dev, PN533_CFGITEM_PASORI,
+                                             pasori_cfg, 3);
+                if (rc) {
+                        nfc_dev_err(&dev->interface->dev,
+                                    "Error while settings PASORI config");
+                        return rc;
+                }
+                pn533_fw_reset(dev);
+                break;
+        }
+        return 0;
+}
 static int pn533_probe(struct usb_interface *interface,
                        const struct usb_device_id *id)
 {
@@ -2121,8 +2276,6 @@ static int pn533_probe(struct usb_interface *interface,
        struct pn533 *dev;
        struct usb_host_interface *iface_desc;
        struct usb_endpoint_descriptor *endpoint;
-        struct pn533_config_max_retries max_retries;
-        struct pn533_config_timing timing;
        int in_endpoint = 0;
        int out_endpoint = 0;
        int rc = -ENOMEM;
@@ -2208,10 +2361,22 @@ static int pn533_probe(struct usb_interface *interface,
        nfc_dev_info(&dev->interface->dev, "NXP PN533 firmware ver %d.%d now"
                                        " attached", fw_ver->ver, fw_ver->rev);
-        protocols = NFC_PROTO_JEWEL_MASK
+        dev->device_type = id->driver_info;
-                        | NFC_PROTO_MIFARE_MASK | NFC_PROTO_FELICA_MASK
+        switch (dev->device_type) {
-                        | NFC_PROTO_ISO14443_MASK
+        case PN533_DEVICE_STD:
-                        | NFC_PROTO_NFC_DEP_MASK;
+                protocols = PN533_ALL_PROTOCOLS;
+                break;
+        case PN533_DEVICE_PASORI:
+                protocols = PN533_NO_TYPE_B_PROTOCOLS;
+                break;
+        default:
+                nfc_dev_err(&dev->interface->dev, "Unknown device type %d\n",
+                            dev->device_type);
+                rc = -EINVAL;
+                goto destroy_wq;
+        }
        dev->nfc_dev = nfc_allocate_device(&pn533_nfc_ops, protocols,
                                           PN533_CMD_DATAEXCH_HEAD_LEN,
@@ -2226,30 +2391,9 @@ static int pn533_probe(struct usb_interface *interface,
        if (rc)
                goto free_nfc_dev;
-        max_retries.mx_rty_atr = PN533_CONFIG_MAX_RETRIES_ENDLESS;
+        rc = pn533_setup(dev);
-        max_retries.mx_rty_psl = 2;
+        if (rc)
-        max_retries.mx_rty_passive_act = PN533_CONFIG_MAX_RETRIES_NO_RETRY;
-        rc = pn533_set_configuration(dev, PN533_CFGITEM_MAX_RETRIES,
-                                (u8 *) &max_retries, sizeof(max_retries));
-        if (rc) {
-                nfc_dev_err(&dev->interface->dev, "Error on setting MAX_RETRIES"
-                                                                " config");
-                goto unregister_nfc_dev;
-        }
-        timing.rfu = PN533_CONFIG_TIMING_102;
-        timing.atr_res_timeout = PN533_CONFIG_TIMING_204;
-        timing.dep_timeout = PN533_CONFIG_TIMING_409;
-        rc = pn533_set_configuration(dev, PN533_CFGITEM_TIMING,
-                                (u8 *) &timing, sizeof(timing));
-        if (rc) {
-                nfc_dev_err(&dev->interface->dev,
-                            "Error on setting RF timings");
                goto unregister_nfc_dev;
-        }
        return 0;
diff --git a/drivers/nfc/pn544_hci.c b/drivers/nfc/pn544_hci.c
index 457eac35dc74..aa71807189ba 100644
--- a/drivers/nfc/pn544_hci.c
+++ b/drivers/nfc/pn544_hci.c
@@ -108,16 +108,22 @@ enum pn544_state {
 #define PN544_NFC_WI_MGMT_GATE                  0xA1
-static u8 pn544_custom_gates[] = {
+static struct nfc_hci_gate pn544_gates[] = {
-        PN544_SYS_MGMT_GATE,
+        {NFC_HCI_ADMIN_GATE, NFC_HCI_INVALID_PIPE},
-        PN544_SWP_MGMT_GATE,
+        {NFC_HCI_LOOPBACK_GATE, NFC_HCI_INVALID_PIPE},
-        PN544_POLLING_LOOP_MGMT_GATE,
+        {NFC_HCI_ID_MGMT_GATE, NFC_HCI_INVALID_PIPE},
-        PN544_NFC_WI_MGMT_GATE,
+        {NFC_HCI_LINK_MGMT_GATE, NFC_HCI_INVALID_PIPE},
-        PN544_RF_READER_F_GATE,
+        {NFC_HCI_RF_READER_B_GATE, NFC_HCI_INVALID_PIPE},
-        PN544_RF_READER_JEWEL_GATE,
+        {NFC_HCI_RF_READER_A_GATE, NFC_HCI_INVALID_PIPE},
-        PN544_RF_READER_ISO15693_GATE,
+        {PN544_SYS_MGMT_GATE, NFC_HCI_INVALID_PIPE},
-        PN544_RF_READER_NFCIP1_INITIATOR_GATE,
+        {PN544_SWP_MGMT_GATE, NFC_HCI_INVALID_PIPE},
-        PN544_RF_READER_NFCIP1_TARGET_GATE
+        {PN544_POLLING_LOOP_MGMT_GATE, NFC_HCI_INVALID_PIPE},
+        {PN544_NFC_WI_MGMT_GATE, NFC_HCI_INVALID_PIPE},
+        {PN544_RF_READER_F_GATE, NFC_HCI_INVALID_PIPE},
+        {PN544_RF_READER_JEWEL_GATE, NFC_HCI_INVALID_PIPE},
+        {PN544_RF_READER_ISO15693_GATE, NFC_HCI_INVALID_PIPE},
+        {PN544_RF_READER_NFCIP1_INITIATOR_GATE, NFC_HCI_INVALID_PIPE},
+        {PN544_RF_READER_NFCIP1_TARGET_GATE, NFC_HCI_INVALID_PIPE}
 };
 /* Largest headroom needed for outgoing custom commands */
@@ -377,6 +383,9 @@ static int pn544_hci_open(struct nfc_shdlc *shdlc)
        r = pn544_hci_enable(info, HCI_MODE);
+        if (r == 0)
+                info->state = PN544_ST_READY;
 out:
        mutex_unlock(&info->info_lock);
        return r;
@@ -393,6 +402,8 @@ static void pn544_hci_close(struct nfc_shdlc *shdlc)
        pn544_hci_disable(info);
+        info->state = PN544_ST_COLD;
 out:
        mutex_unlock(&info->info_lock);
 }
@@ -844,10 +855,9 @@ static int __devinit pn544_hci_probe(struct i2c_client *client,
                goto err_rti;
        }
-        init_data.gate_count = ARRAY_SIZE(pn544_custom_gates);
+        init_data.gate_count = ARRAY_SIZE(pn544_gates);
-        memcpy(init_data.gates, pn544_custom_gates,
+        memcpy(init_data.gates, pn544_gates, sizeof(pn544_gates));
-               ARRAY_SIZE(pn544_custom_gates));
        /*
         * TODO: Session id must include the driver name + some bus addr
@@ -859,6 +869,7 @@ static int __devinit pn544_hci_probe(struct i2c_client *client,
                    NFC_PROTO_MIFARE_MASK |
                    NFC_PROTO_FELICA_MASK |
                    NFC_PROTO_ISO14443_MASK |
+                    NFC_PROTO_ISO14443_B_MASK |
                    NFC_PROTO_NFC_DEP_MASK;
        info->shdlc = nfc_shdlc_allocate(&pn544_shdlc_ops,
diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index 12334f9190cb..03b2f30d2ace 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -137,6 +137,36 @@ struct bcma_host_ops {
 #define BCMA_MAX_NR_CORES               16
+/* Chip IDs of PCIe devices */
+#define BCMA_CHIP_ID_BCM4313    0x4313
+#define BCMA_CHIP_ID_BCM43224   43224
+#define  BCMA_PKG_ID_BCM43224_FAB_CSM   0x8
+#define  BCMA_PKG_ID_BCM43224_FAB_SMIC  0xa
+#define BCMA_CHIP_ID_BCM43225   43225
+#define BCMA_CHIP_ID_BCM43227   43227
+#define BCMA_CHIP_ID_BCM43228   43228
+#define BCMA_CHIP_ID_BCM43421   43421
+#define BCMA_CHIP_ID_BCM43428   43428
+#define BCMA_CHIP_ID_BCM43431   43431
+#define BCMA_CHIP_ID_BCM43460   43460
+#define BCMA_CHIP_ID_BCM4331    0x4331
+#define BCMA_CHIP_ID_BCM6362    0x6362
+#define BCMA_CHIP_ID_BCM4360    0x4360
+#define BCMA_CHIP_ID_BCM4352    0x4352
+/* Chip IDs of SoCs */
+#define BCMA_CHIP_ID_BCM4706    0x5300
+#define BCMA_CHIP_ID_BCM4716    0x4716
+#define  BCMA_PKG_ID_BCM4716    8
+#define  BCMA_PKG_ID_BCM4717    9
+#define  BCMA_PKG_ID_BCM4718    10
+#define BCMA_CHIP_ID_BCM47162   47162
+#define BCMA_CHIP_ID_BCM4748    0x4748
+#define BCMA_CHIP_ID_BCM4749    0x4749
+#define BCMA_CHIP_ID_BCM5356    0x5356
+#define BCMA_CHIP_ID_BCM5357    0x5357
+#define BCMA_CHIP_ID_BCM53572   53572
 struct bcma_device {
        struct bcma_bus *bus;
        struct bcma_device_id id;
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
index 8bbfe31fbac8..fbd0d49dc4d2 100644
--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -88,6 +88,11 @@
 #define  BCMA_CC_CHIPST_4313_OTP_PRESENT        2
 #define  BCMA_CC_CHIPST_4331_SPROM_PRESENT      2
 #define  BCMA_CC_CHIPST_4331_OTP_PRESENT        4
+#define  BCMA_CC_CHIPST_4706_PKG_OPTION         BIT(0) /* 0: full-featured package 1: low-cost package */
+#define  BCMA_CC_CHIPST_4706_SFLASH_PRESENT     BIT(1) /* 0: parallel, 1: serial flash is present */
+#define  BCMA_CC_CHIPST_4706_SFLASH_TYPE        BIT(2) /* 0: 8b-p/ST-s flash, 1: 16b-p/Atmal-s flash */
+#define  BCMA_CC_CHIPST_4706_MIPS_BENDIAN       BIT(3) /* 0: little, 1: big endian */
+#define  BCMA_CC_CHIPST_4706_PCIE1_DISABLE      BIT(5) /* PCIE1 enable strap pin */
 #define BCMA_CC_JCMD                    0x0030          /* Rev >= 10 only */
 #define  BCMA_CC_JCMD_START             0x80000000
 #define  BCMA_CC_JCMD_BUSY              0x80000000
@@ -280,6 +285,15 @@
 /* 4706 PMU */
 #define BCMA_CC_PMU4706_MAINPLL_PLL0    0
+#define BCMA_CC_PMU6_4706_PROCPLL_OFF   4       /* The CPU PLL */
+#define  BCMA_CC_PMU6_4706_PROC_P2DIV_MASK      0x000f0000
+#define  BCMA_CC_PMU6_4706_PROC_P2DIV_SHIFT     16
+#define  BCMA_CC_PMU6_4706_PROC_P1DIV_MASK      0x0000f000
+#define  BCMA_CC_PMU6_4706_PROC_P1DIV_SHIFT     12
+#define  BCMA_CC_PMU6_4706_PROC_NDIV_INT_MASK   0x00000ff8
+#define  BCMA_CC_PMU6_4706_PROC_NDIV_INT_SHIFT  3
+#define  BCMA_CC_PMU6_4706_PROC_NDIV_MODE_MASK  0x00000007
+#define  BCMA_CC_PMU6_4706_PROC_NDIV_MODE_SHIFT 0
 /* ALP clock on pre-PMU chips */
 #define BCMA_CC_PMU_ALP_CLOCK           20000000
@@ -308,6 +322,19 @@
 #define BCMA_CC_PPL_PCHI_OFF            5
 #define BCMA_CC_PPL_PCHI_MASK           0x0000003f
+#define BCMA_CC_PMU_PLL_CTL0            0
+#define BCMA_CC_PMU_PLL_CTL1            1
+#define BCMA_CC_PMU_PLL_CTL2            2
+#define BCMA_CC_PMU_PLL_CTL3            3
+#define BCMA_CC_PMU_PLL_CTL4            4
+#define BCMA_CC_PMU_PLL_CTL5            5
+#define BCMA_CC_PMU1_PLL0_PC0_P1DIV_MASK        0x00f00000
+#define BCMA_CC_PMU1_PLL0_PC0_P1DIV_SHIFT       20
+#define BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_MASK     0x1ff00000
+#define BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_SHIFT    20
 /* BCM4331 ChipControl numbers. */
 #define BCMA_CHIPCTL_4331_BT_COEXIST            BIT(0)  /* 0 disable */
 #define BCMA_CHIPCTL_4331_SECI                  BIT(1)  /* 0 SECI is disabled (JATG functional) */
@@ -321,9 +348,18 @@
 #define BCMA_CHIPCTL_4331_OVR_PIPEAUXPWRDOWN    BIT(9)  /* override core control on pipe_AuxPowerDown */
 #define BCMA_CHIPCTL_4331_PCIE_AUXCLKEN         BIT(10) /* pcie_auxclkenable */
 #define BCMA_CHIPCTL_4331_PCIE_PIPE_PLLDOWN     BIT(11) /* pcie_pipe_pllpowerdown */
+#define BCMA_CHIPCTL_4331_EXTPA_EN2             BIT(12) /* 0 ext pa disable, 1 ext pa enabled */
 #define BCMA_CHIPCTL_4331_BT_SHD0_ON_GPIO4      BIT(16) /* enable bt_shd0 at gpio4 */
 #define BCMA_CHIPCTL_4331_BT_SHD1_ON_GPIO5      BIT(17) /* enable bt_shd1 at gpio5 */
+/* 43224 chip-specific ChipControl register bits */
+#define BCMA_CCTRL_43224_GPIO_TOGGLE            0x8000          /* gpio[3:0] pins as btcoex or s/w gpio */
+#define BCMA_CCTRL_43224A0_12MA_LED_DRIVE       0x00F000F0      /* 12 mA drive strength */
+#define BCMA_CCTRL_43224B0_12MA_LED_DRIVE       0xF0            /* 12 mA drive strength for later 43224s */
+/* 4313 Chip specific ChipControl register bits */
+#define BCMA_CCTRL_4313_12MA_LED_DRIVE          0x00000007      /* 12 mA drive strengh for later 4313 */
 /* Data for the PMU, if available.
 * Check availability with ((struct bcma_chipcommon)->capabilities & BCMA_CC_CAP_PMU)
 */
@@ -411,5 +447,6 @@ extern void bcma_chipco_chipctl_maskset(struct bcma_drv_cc *cc,
                                        u32 offset, u32 mask, u32 set);
 extern void bcma_chipco_regctl_maskset(struct bcma_drv_cc *cc,
                                       u32 offset, u32 mask, u32 set);
+extern void bcma_pmu_spuravoid_pllupdate(struct bcma_drv_cc *cc, int spuravoid);
 #endif /* LINUX_BCMA_DRIVER_CC_H_ */
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 318fc1f705b1..e02fc682bb68 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -47,6 +47,7 @@
 #define IEEE80211_FCTL_MOREDATA         0x2000
 #define IEEE80211_FCTL_PROTECTED        0x4000
 #define IEEE80211_FCTL_ORDER            0x8000
+#define IEEE80211_FCTL_CTL_EXT          0x0f00
 #define IEEE80211_SCTL_FRAG             0x000F
 #define IEEE80211_SCTL_SEQ              0xFFF0
@@ -54,6 +55,7 @@
 #define IEEE80211_FTYPE_MGMT            0x0000
 #define IEEE80211_FTYPE_CTL             0x0004
 #define IEEE80211_FTYPE_DATA            0x0008
+#define IEEE80211_FTYPE_EXT             0x000c
 /* management */
 #define IEEE80211_STYPE_ASSOC_REQ       0x0000
@@ -70,6 +72,7 @@
 #define IEEE80211_STYPE_ACTION          0x00D0
 /* control */
+#define IEEE80211_STYPE_CTL_EXT         0x0060
 #define IEEE80211_STYPE_BACK_REQ        0x0080
 #define IEEE80211_STYPE_BACK            0x0090
 #define IEEE80211_STYPE_PSPOLL          0x00A0
@@ -97,6 +100,18 @@
 #define IEEE80211_STYPE_QOS_CFPOLL              0x00E0
 #define IEEE80211_STYPE_QOS_CFACKPOLL           0x00F0
+/* extension, added by 802.11ad */
+#define IEEE80211_STYPE_DMG_BEACON              0x0000
+/* control extension - for IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTL_EXT */
+#define IEEE80211_CTL_EXT_POLL          0x2000
+#define IEEE80211_CTL_EXT_SPR           0x3000
+#define IEEE80211_CTL_EXT_GRANT 0x4000
+#define IEEE80211_CTL_EXT_DMG_CTS       0x5000
+#define IEEE80211_CTL_EXT_DMG_DTS       0x6000
+#define IEEE80211_CTL_EXT_SSW           0x8000
+#define IEEE80211_CTL_EXT_SSW_FBACK     0x9000
+#define IEEE80211_CTL_EXT_SSW_ACK       0xa000
 /* miscellaneous IEEE 802.11 constants */
 #define IEEE80211_MAX_FRAG_THRESHOLD    2352
@@ -1092,6 +1107,73 @@ struct ieee80211_ht_operation {
 #define WLAN_HT_SMPS_CONTROL_STATIC     1
 #define WLAN_HT_SMPS_CONTROL_DYNAMIC    3
+#define VHT_MCS_SUPPORTED_SET_SIZE      8
+struct ieee80211_vht_capabilities {
+        __le32 vht_capabilities_info;
+        u8 vht_supported_mcs_set[VHT_MCS_SUPPORTED_SET_SIZE];
+} __packed;
+struct ieee80211_vht_operation {
+        u8 vht_op_info_chwidth;
+        u8 vht_op_info_chan_center_freq_seg1_idx;
+        u8 vht_op_info_chan_center_freq_seg2_idx;
+        __le16 vht_basic_mcs_set;
+} __packed;
+/**
+ * struct ieee80211_vht_mcs_info - VHT MCS information
+ * @rx_mcs_map: RX MCS map 2 bits for each stream, total 8 streams
+ * @rx_highest: Indicates highest long GI VHT PPDU data rate
+ *      STA can receive. Rate expressed in units of 1 Mbps.
+ *      If this field is 0 this value should not be used to
+ *      consider the highest RX data rate supported.
+ * @tx_mcs_map: TX MCS map 2 bits for each stream, total 8 streams
+ * @tx_highest: Indicates highest long GI VHT PPDU data rate
+ *      STA can transmit. Rate expressed in units of 1 Mbps.
+ *      If this field is 0 this value should not be used to
+ *      consider the highest TX data rate supported.
+ */
+struct ieee80211_vht_mcs_info {
+        __le16 rx_mcs_map;
+        __le16 rx_highest;
+        __le16 tx_mcs_map;
+        __le16 tx_highest;
+} __packed;
+#define IEEE80211_VHT_MCS_ZERO_TO_SEVEN_SUPPORT 0
+#define IEEE80211_VHT_MCS_ZERO_TO_EIGHT_SUPPORT 1
+#define IEEE80211_VHT_MCS_ZERO_TO_NINE_SUPPORT  2
+#define IEEE80211_VHT_MCS_NOT_SUPPORTED 3
+/* 802.11ac VHT Capabilities */
+#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895                0x00000000
+#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991                0x00000001
+#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454               0x00000002
+#define IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ              0x00000004
+#define IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ     0x00000008
+#define IEEE80211_VHT_CAP_RXLDPC                              0x00000010
+#define IEEE80211_VHT_CAP_SHORT_GI_80                         0x00000020
+#define IEEE80211_VHT_CAP_SHORT_GI_160                        0x00000040
+#define IEEE80211_VHT_CAP_TXSTBC                              0x00000080
+#define IEEE80211_VHT_CAP_RXSTBC_1                            0x00000100
+#define IEEE80211_VHT_CAP_RXSTBC_2                            0x00000200
+#define IEEE80211_VHT_CAP_RXSTBC_3                            0x00000300
+#define IEEE80211_VHT_CAP_RXSTBC_4                            0x00000400
+#define IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE               0x00000800
+#define IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE               0x00001000
+#define IEEE80211_VHT_CAP_BEAMFORMER_ANTENNAS_MAX             0x00006000
+#define IEEE80211_VHT_CAP_SOUNDING_DIMENTION_MAX              0x00030000
+#define IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE               0x00080000
+#define IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE               0x00100000
+#define IEEE80211_VHT_CAP_VHT_TXOP_PS                         0x00200000
+#define IEEE80211_VHT_CAP_HTC_VHT                             0x00400000
+#define IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT          0x00800000
+#define IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_UNSOL_MFB   0x08000000
+#define IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB     0x0c000000
+#define IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN                  0x10000000
+#define IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN                  0x20000000
 /* Authentication algorithms */
 #define WLAN_AUTH_OPEN 0
 #define WLAN_AUTH_SHARED_KEY 1
@@ -1124,6 +1206,21 @@ struct ieee80211_ht_operation {
 #define WLAN_CAPABILITY_QOS             (1<<9)
 #define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10)
 #define WLAN_CAPABILITY_DSSS_OFDM       (1<<13)
+/* DMG (60gHz) 802.11ad */
+/* type - bits 0..1 */
+#define WLAN_CAPABILITY_DMG_TYPE_IBSS           (1<<0) /* Tx by: STA */
+#define WLAN_CAPABILITY_DMG_TYPE_PBSS           (2<<0) /* Tx by: PCP */
+#define WLAN_CAPABILITY_DMG_TYPE_AP             (3<<0) /* Tx by: AP */
+#define WLAN_CAPABILITY_DMG_CBAP_ONLY           (1<<2)
+#define WLAN_CAPABILITY_DMG_CBAP_SOURCE (1<<3)
+#define WLAN_CAPABILITY_DMG_PRIVACY             (1<<4)
+#define WLAN_CAPABILITY_DMG_ECPAC               (1<<5)
+#define WLAN_CAPABILITY_DMG_SPECTRUM_MGMT       (1<<8)
+#define WLAN_CAPABILITY_DMG_RADIO_MEASURE       (1<<12)
 /* measurement */
 #define IEEE80211_SPCT_MSR_RPRT_MODE_LATE       (1<<0)
 #define IEEE80211_SPCT_MSR_RPRT_MODE_INCAPABLE  (1<<1)
@@ -1133,7 +1230,6 @@ struct ieee80211_ht_operation {
 #define IEEE80211_SPCT_MSR_RPRT_TYPE_CCA        1
 #define IEEE80211_SPCT_MSR_RPRT_TYPE_RPI        2
 /* 802.11g ERP information element */
 #define WLAN_ERP_NON_ERP_PRESENT (1<<0)
 #define WLAN_ERP_USE_PROTECTION (1<<1)
@@ -1145,6 +1241,16 @@ enum {
        WLAN_ERP_PREAMBLE_LONG = 1,
 };
+/* Band ID, 802.11ad #8.4.1.45 */
+enum {
+        IEEE80211_BANDID_TV_WS = 0, /* TV white spaces */
+        IEEE80211_BANDID_SUB1  = 1, /* Sub-1 GHz (excluding TV white spaces) */
+        IEEE80211_BANDID_2G    = 2, /* 2.4 GHz */
+        IEEE80211_BANDID_3G    = 3, /* 3.6 GHz */
+        IEEE80211_BANDID_5G    = 4, /* 4.9 and 5 GHz */
+        IEEE80211_BANDID_60G   = 5, /* 60 GHz */
+};
 /* Status codes */
 enum ieee80211_statuscode {
        WLAN_STATUS_SUCCESS = 0,
@@ -1196,6 +1302,17 @@ enum ieee80211_statuscode {
        WLAN_STATUS_ANTI_CLOG_REQUIRED = 76,
        WLAN_STATUS_FCG_NOT_SUPP = 78,
        WLAN_STATUS_STA_NO_TBTT = 78,
+        /* 802.11ad */
+        WLAN_STATUS_REJECTED_WITH_SUGGESTED_CHANGES = 39,
+        WLAN_STATUS_REJECTED_FOR_DELAY_PERIOD = 47,
+        WLAN_STATUS_REJECT_WITH_SCHEDULE = 83,
+        WLAN_STATUS_PENDING_ADMITTING_FST_SESSION = 86,
+        WLAN_STATUS_PERFORMING_FST_NOW = 87,
+        WLAN_STATUS_PENDING_GAP_IN_BA_WINDOW = 88,
+        WLAN_STATUS_REJECT_U_PID_SETTING = 89,
+        WLAN_STATUS_REJECT_DSE_BAND = 96,
+        WLAN_STATUS_DENIED_WITH_SUGGESTED_BAND_AND_CHANNEL = 99,
+        WLAN_STATUS_DENIED_DUE_TO_SPECTRUM_MANAGEMENT = 103,
 };
@@ -1352,6 +1469,43 @@ enum ieee80211_eid {
        WLAN_EID_DSE_REGISTERED_LOCATION = 58,
        WLAN_EID_SUPPORTED_REGULATORY_CLASSES = 59,
        WLAN_EID_EXT_CHANSWITCH_ANN = 60,
+        WLAN_EID_VHT_CAPABILITY = 191,
+        WLAN_EID_VHT_OPERATION = 192,
+        /* 802.11ad */
+        WLAN_EID_NON_TX_BSSID_CAP =  83,
+        WLAN_EID_WAKEUP_SCHEDULE = 143,
+        WLAN_EID_EXT_SCHEDULE = 144,
+        WLAN_EID_STA_AVAILABILITY = 145,
+        WLAN_EID_DMG_TSPEC = 146,
+        WLAN_EID_DMG_AT = 147,
+        WLAN_EID_DMG_CAP = 148,
+        WLAN_EID_DMG_OPERATION = 151,
+        WLAN_EID_DMG_BSS_PARAM_CHANGE = 152,
+        WLAN_EID_DMG_BEAM_REFINEMENT = 153,
+        WLAN_EID_CHANNEL_MEASURE_FEEDBACK = 154,
+        WLAN_EID_AWAKE_WINDOW = 157,
+        WLAN_EID_MULTI_BAND = 158,
+        WLAN_EID_ADDBA_EXT = 159,
+        WLAN_EID_NEXT_PCP_LIST = 160,
+        WLAN_EID_PCP_HANDOVER = 161,
+        WLAN_EID_DMG_LINK_MARGIN = 162,
+        WLAN_EID_SWITCHING_STREAM = 163,
+        WLAN_EID_SESSION_TRANSITION = 164,
+        WLAN_EID_DYN_TONE_PAIRING_REPORT = 165,
+        WLAN_EID_CLUSTER_REPORT = 166,
+        WLAN_EID_RELAY_CAP = 167,
+        WLAN_EID_RELAY_XFER_PARAM_SET = 168,
+        WLAN_EID_BEAM_LINK_MAINT = 169,
+        WLAN_EID_MULTIPLE_MAC_ADDR = 170,
+        WLAN_EID_U_PID = 171,
+        WLAN_EID_DMG_LINK_ADAPT_ACK = 172,
+        WLAN_EID_QUIET_PERIOD_REQ = 175,
+        WLAN_EID_QUIET_PERIOD_RESP = 177,
+        WLAN_EID_EPAC_POLICY = 182,
+        WLAN_EID_CLISTER_TIME_OFF = 183,
+        WLAN_EID_ANTENNA_SECTOR_ID_PATTERN = 190,
 };
 /* Action category code */
@@ -1368,7 +1522,10 @@ enum ieee80211_category {
        WLAN_CATEGORY_MESH_ACTION = 13,
        WLAN_CATEGORY_MULTIHOP_ACTION = 14,
        WLAN_CATEGORY_SELF_PROTECTED = 15,
+        WLAN_CATEGORY_DMG = 16,
        WLAN_CATEGORY_WMM = 17,
+        WLAN_CATEGORY_FST = 18,
+        WLAN_CATEGORY_UNPROT_DMG = 20,
        WLAN_CATEGORY_VENDOR_SPECIFIC_PROTECTED = 126,
        WLAN_CATEGORY_VENDOR_SPECIFIC = 127,
 };
@@ -1616,6 +1773,7 @@ enum ieee80211_sa_query_action {
 #define WLAN_CIPHER_SUITE_CCMP          0x000FAC04
 #define WLAN_CIPHER_SUITE_WEP104        0x000FAC05
 #define WLAN_CIPHER_SUITE_AES_CMAC      0x000FAC06
+#define WLAN_CIPHER_SUITE_GCMP          0x000FAC08
 #define WLAN_CIPHER_SUITE_SMS4          0x00147201
diff --git a/include/linux/nfc.h b/include/linux/nfc.h
index f4e6dd915b1c..6189f27e305b 100644
--- a/include/linux/nfc.h
+++ b/include/linux/nfc.h
@@ -136,8 +136,9 @@ enum nfc_attrs {
 #define NFC_PROTO_FELICA        3
 #define NFC_PROTO_ISO14443      4
 #define NFC_PROTO_NFC_DEP       5
+#define NFC_PROTO_ISO14443_B    6
-#define NFC_PROTO_MAX           6
+#define NFC_PROTO_MAX           7
 /* NFC communication modes */
 #define NFC_COMM_ACTIVE  0
@@ -149,11 +150,12 @@ enum nfc_attrs {
 #define NFC_RF_NONE      2
 /* NFC protocols masks used in bitsets */
-#define NFC_PROTO_JEWEL_MASK    (1 << NFC_PROTO_JEWEL)
+#define NFC_PROTO_JEWEL_MASK      (1 << NFC_PROTO_JEWEL)
-#define NFC_PROTO_MIFARE_MASK   (1 << NFC_PROTO_MIFARE)
+#define NFC_PROTO_MIFARE_MASK     (1 << NFC_PROTO_MIFARE)
-#define NFC_PROTO_FELICA_MASK   (1 << NFC_PROTO_FELICA)
+#define NFC_PROTO_FELICA_MASK     (1 << NFC_PROTO_FELICA)
-#define NFC_PROTO_ISO14443_MASK (1 << NFC_PROTO_ISO14443)
+#define NFC_PROTO_ISO14443_MASK   (1 << NFC_PROTO_ISO14443)
-#define NFC_PROTO_NFC_DEP_MASK  (1 << NFC_PROTO_NFC_DEP)
+#define NFC_PROTO_NFC_DEP_MASK    (1 << NFC_PROTO_NFC_DEP)
+#define NFC_PROTO_ISO14443_B_MASK (1 << NFC_PROTO_ISO14443_B)
 struct sockaddr_nfc {
        sa_family_t sa_family;
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index c0fc5d277338..db961a59247f 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -1638,12 +1638,20 @@ struct nl80211_sta_flag_update {
 *
 * These attribute types are used with %NL80211_STA_INFO_TXRATE
 * when getting information about the bitrate of a station.
+ * There are 2 attributes for bitrate, a legacy one that represents
+ * a 16-bit value, and new one that represents a 32-bit value.
+ * If the rate value fits into 16 bit, both attributes are reported
+ * with the same value. If the rate is too high to fit into 16 bits
+ * (>6.5535Gbps) only 32-bit attribute is included.
+ * User space tools encouraged to use the 32-bit attribute and fall
+ * back to the 16-bit one for compatibility with older kernels.
 *
 * @__NL80211_RATE_INFO_INVALID: attribute number 0 is reserved
 * @NL80211_RATE_INFO_BITRATE: total bitrate (u16, 100kbit/s)
 * @NL80211_RATE_INFO_MCS: mcs index for 802.11n (u8)
 * @NL80211_RATE_INFO_40_MHZ_WIDTH: 40 Mhz dualchannel bitrate
 * @NL80211_RATE_INFO_SHORT_GI: 400ns guard interval
+ * @NL80211_RATE_INFO_BITRATE32: total bitrate (u32, 100kbit/s)
 * @NL80211_RATE_INFO_MAX: highest rate_info number currently defined
 * @__NL80211_RATE_INFO_AFTER_LAST: internal use
 */
@@ -1653,6 +1661,7 @@ enum nl80211_rate_info {
        NL80211_RATE_INFO_MCS,
        NL80211_RATE_INFO_40_MHZ_WIDTH,
        NL80211_RATE_INFO_SHORT_GI,
+        NL80211_RATE_INFO_BITRATE32,
        /* keep last */
        __NL80211_RATE_INFO_AFTER_LAST,
@@ -1813,6 +1822,9 @@ enum nl80211_mpath_info {
 * @NL80211_BAND_ATTR_HT_CAPA: HT capabilities, as in the HT information IE
 * @NL80211_BAND_ATTR_HT_AMPDU_FACTOR: A-MPDU factor, as in 11n
 * @NL80211_BAND_ATTR_HT_AMPDU_DENSITY: A-MPDU density, as in 11n
+ * @NL80211_BAND_ATTR_VHT_MCS_SET: 32-byte attribute containing the MCS set as
+ *      defined in 802.11ac
+ * @NL80211_BAND_ATTR_VHT_CAPA: VHT capabilities, as in the HT information IE
 * @NL80211_BAND_ATTR_MAX: highest band attribute currently defined
 * @__NL80211_BAND_ATTR_AFTER_LAST: internal use
 */
@@ -1826,6 +1838,9 @@ enum nl80211_band_attr {
        NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
        NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
+        NL80211_BAND_ATTR_VHT_MCS_SET,
+        NL80211_BAND_ATTR_VHT_CAPA,
        /* keep last */
        __NL80211_BAND_ATTR_AFTER_LAST,
        NL80211_BAND_ATTR_MAX = __NL80211_BAND_ATTR_AFTER_LAST - 1
@@ -2539,10 +2554,12 @@ enum nl80211_tx_rate_attributes {
 * enum nl80211_band - Frequency band
 * @NL80211_BAND_2GHZ: 2.4 GHz ISM band
 * @NL80211_BAND_5GHZ: around 5 GHz band (4.9 - 5.7 GHz)
+ * @NL80211_BAND_60GHZ: around 60 GHz band (58.32 - 64.80 GHz)
 */
 enum nl80211_band {
        NL80211_BAND_2GHZ,
        NL80211_BAND_5GHZ,
+        NL80211_BAND_60GHZ,
 };
 /**
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 061c01957e54..51f67a9003a9 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -70,11 +70,13 @@
 *
 * @IEEE80211_BAND_2GHZ: 2.4GHz ISM band
 * @IEEE80211_BAND_5GHZ: around 5GHz band (4.9-5.7)
+ * @IEEE80211_BAND_60GHZ: around 60 GHz band (58.32 - 64.80 GHz)
 * @IEEE80211_NUM_BANDS: number of defined bands
 */
 enum ieee80211_band {
        IEEE80211_BAND_2GHZ = NL80211_BAND_2GHZ,
        IEEE80211_BAND_5GHZ = NL80211_BAND_5GHZ,
+        IEEE80211_BAND_60GHZ = NL80211_BAND_60GHZ,
        /* keep last */
        IEEE80211_NUM_BANDS
@@ -211,6 +213,22 @@ struct ieee80211_sta_ht_cap {
 };
 /**
+ * struct ieee80211_sta_vht_cap - STA's VHT capabilities
+ *
+ * This structure describes most essential parameters needed
+ * to describe 802.11ac VHT capabilities for an STA.
+ *
+ * @vht_supported: is VHT supported by the STA
+ * @cap: VHT capabilities map as described in 802.11ac spec
+ * @vht_mcs: Supported VHT MCS rates
+ */
+struct ieee80211_sta_vht_cap {
+        bool vht_supported;
+        u32 cap; /* use IEEE80211_VHT_CAP_ */
+        struct ieee80211_vht_mcs_info vht_mcs;
+};
+/**
 * struct ieee80211_supported_band - frequency band definition
 *
 * This structure describes a frequency band a wiphy
@@ -233,6 +251,7 @@ struct ieee80211_supported_band {
        int n_channels;
        int n_bitrates;
        struct ieee80211_sta_ht_cap ht_cap;
+        struct ieee80211_sta_vht_cap vht_cap;
 };
 /*
@@ -561,11 +580,13 @@ enum station_info_flags {
 * @RATE_INFO_FLAGS_MCS: @tx_bitrate_mcs filled
 * @RATE_INFO_FLAGS_40_MHZ_WIDTH: 40 Mhz width transmission
 * @RATE_INFO_FLAGS_SHORT_GI: 400ns guard interval
+ * @RATE_INFO_FLAGS_60G: 60gHz MCS
 */
 enum rate_info_flags {
        RATE_INFO_FLAGS_MCS             = 1<<0,
        RATE_INFO_FLAGS_40_MHZ_WIDTH    = 1<<1,
        RATE_INFO_FLAGS_SHORT_GI        = 1<<2,
+        RATE_INFO_FLAGS_60G             = 1<<3,
 };
 /**
@@ -1482,9 +1503,8 @@ struct cfg80211_gtk_rekey_data {
 *      interfaces are active this callback should reject the configuration.
 *      If no interfaces are active or the device is down, the channel should
 *      be stored for when a monitor interface becomes active.
- * @get_channel: Get the current operating channel, should return %NULL if
+ * @set_monitor_enabled: Notify driver that there are only monitor
- *      there's no single defined operating channel if for example the
+ *      interfaces running.
- *      device implements channel hopping for multi-channel virtual interfaces.
 *
 * @scan: Request to do a scan. If returning zero, the scan request is given
 *      the driver, and will be valid until passed to cfg80211_scan_done().
@@ -1791,15 +1811,14 @@ struct cfg80211_ops {
                                  struct net_device *dev,
                                  u16 noack_map);
-        struct ieee80211_channel *(*get_channel)(struct wiphy *wiphy,
-                                               enum nl80211_channel_type *type);
        int     (*get_et_sset_count)(struct wiphy *wiphy,
                                     struct net_device *dev, int sset);
        void    (*get_et_stats)(struct wiphy *wiphy, struct net_device *dev,
                                struct ethtool_stats *stats, u64 *data);
        void    (*get_et_strings)(struct wiphy *wiphy, struct net_device *dev,
                                  u32 sset, u8 *data);
+        void (*set_monitor_enabled)(struct wiphy *wiphy, bool enabled);
 };
 /*
@@ -2153,7 +2172,9 @@ struct wiphy {
        char fw_version[ETHTOOL_BUSINFO_LEN];
        u32 hw_version;
+#ifdef CONFIG_PM
        struct wiphy_wowlan_support wowlan;
+#endif
        u16 max_remain_on_channel_duration;
@@ -2389,6 +2410,11 @@ struct wireless_dev {
        struct ieee80211_channel *preset_chan;
        enum nl80211_channel_type preset_chantype;
+        /* for AP and mesh channel tracking */
+        struct ieee80211_channel *channel;
+        bool ibss_fixed;
        bool ps;
        int ps_timeout;
@@ -3463,7 +3489,7 @@ void cfg80211_ch_switch_notify(struct net_device *dev, int freq,
 *
 * return 0 if MCS index >= 32
 */
-u16 cfg80211_calculate_bitrate(struct rate_info *rate);
+u32 cfg80211_calculate_bitrate(struct rate_info *rate);
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 670a58ba8a41..e3fa90ce9ecb 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -475,7 +475,7 @@ enum mac80211_rate_control_flags {
 #define IEEE80211_TX_INFO_RATE_DRIVER_DATA_SIZE 24
 /* maximum number of rate stages */
-#define IEEE80211_TX_MAX_RATES  5
+#define IEEE80211_TX_MAX_RATES  4
 /**
 * struct ieee80211_tx_rate - rate selection/status
@@ -563,11 +563,11 @@ struct ieee80211_tx_info {
                } control;
                struct {
                        struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];
-                        u8 ampdu_ack_len;
                        int ack_signal;
+                        u8 ampdu_ack_len;
                        u8 ampdu_len;
                        u8 antenna;
-                        /* 14 bytes free */
+                        /* 21 bytes free */
                } status;
                struct {
                        struct ieee80211_tx_rate driver_rates[
@@ -634,7 +634,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
                info->status.rates[i].count = 0;
        BUILD_BUG_ON(
-            offsetof(struct ieee80211_tx_info, status.ampdu_ack_len) != 23);
+            offsetof(struct ieee80211_tx_info, status.ack_signal) != 20);
        memset(&info->status.ampdu_ack_len, 0,
               sizeof(struct ieee80211_tx_info) -
               offsetof(struct ieee80211_tx_info, status.ampdu_ack_len));
@@ -1896,19 +1896,6 @@ enum ieee80211_rate_control_changed {
 *      The low-level driver should send the frame out based on
 *      configuration in the TX control data. This handler should,
 *      preferably, never fail and stop queues appropriately.
- *      This must be implemented if @tx_frags is not.
- *      Must be atomic.
- *
- * @tx_frags: Called to transmit multiple fragments of a single MSDU.
- *      This handler must consume all fragments, sending out some of
- *      them only is useless and it can't ask for some of them to be
- *      queued again. If the frame is not fragmented the queue has a
- *      single SKB only. To avoid issues with the networking stack
- *      when TX status is reported the frames should be removed from
- *      the skb queue.
- *      If this is used, the tx_info @vif and @sta pointers will be
- *      invalid -- you must not use them in that case.
- *      This must be implemented if @tx isn't.
 *      Must be atomic.
 *
 * @start: Called before the first netdevice attached to the hardware
@@ -2257,11 +2244,21 @@ enum ieee80211_rate_control_changed {
 * @get_rssi: Get current signal strength in dBm, the function is optional
 *      and can sleep.
 *
+ * @mgd_prepare_tx: Prepare for transmitting a management frame for association
+ *      before associated. In multi-channel scenarios, a virtual interface is
+ *      bound to a channel before it is associated, but as it isn't associated
+ *      yet it need not necessarily be given airtime, in particular since any
+ *      transmission to a P2P GO needs to be synchronized against the GO's
+ *      powersave state. mac80211 will call this function before transmitting a
+ *      management frame prior to having successfully associated to allow the
+ *      driver to give it channel time for the transmission, to get a response
+ *      and to be able to synchronize with the GO.
+ *      The callback will be called before each transmission and upon return
+ *      mac80211 will transmit the frame right away.
+ *      The callback is optional and can (should!) sleep.
 */
 struct ieee80211_ops {
        void (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
-        void (*tx_frags)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-                         struct ieee80211_sta *sta, struct sk_buff_head *skbs);
        int (*start)(struct ieee80211_hw *hw);
        void (*stop)(struct ieee80211_hw *hw);
 #ifdef CONFIG_PM
@@ -2398,6 +2395,9 @@ struct ieee80211_ops {
                                  u32 sset, u8 *data);
        int     (*get_rssi)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                            struct ieee80211_sta *sta, s8 *rssi_dbm);
+        void    (*mgd_prepare_tx)(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif);
 };
 /**
@@ -3832,12 +3832,6 @@ void ieee80211_enable_rssi_reports(struct ieee80211_vif *vif,
 void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif);
-int ieee80211_add_srates_ie(struct ieee80211_vif *vif,
-                            struct sk_buff *skb, bool need_basic);
-int ieee80211_add_ext_srates_ie(struct ieee80211_vif *vif,
-                                struct sk_buff *skb, bool need_basic);
 /**
 * ieee80211_ave_rssi - report the average rssi for the specified interface
 *
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index e30e6a869714..f5169b04f082 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -44,10 +44,20 @@ struct nfc_hci_ops {
                              struct nfc_target *target);
 };
-#define NFC_HCI_MAX_CUSTOM_GATES        15
+/* Pipes */
+#define NFC_HCI_INVALID_PIPE    0x80
+#define NFC_HCI_LINK_MGMT_PIPE  0x00
+#define NFC_HCI_ADMIN_PIPE      0x01
+struct nfc_hci_gate {
+        u8 gate;
+        u8 pipe;
+};
+#define NFC_HCI_MAX_CUSTOM_GATES        50
 struct nfc_hci_init_data {
        u8 gate_count;
-        u8 gates[NFC_HCI_MAX_CUSTOM_GATES];
+        struct nfc_hci_gate gates[NFC_HCI_MAX_CUSTOM_GATES];
        char session_id[9];
 };
@@ -112,6 +122,8 @@ void nfc_hci_unregister_device(struct nfc_hci_dev *hdev);
 void nfc_hci_set_clientdata(struct nfc_hci_dev *hdev, void *clientdata);
 void *nfc_hci_get_clientdata(struct nfc_hci_dev *hdev);
+void nfc_hci_driver_failure(struct nfc_hci_dev *hdev, int err);
 /* Host IDs */
 #define NFC_HCI_HOST_CONTROLLER_ID      0x00
 #define NFC_HCI_TERMINAL_HOST_ID        0x01
@@ -180,7 +192,8 @@ void nfc_hci_event_received(struct nfc_hci_dev *hdev, u8 pipe, u8 event,
 void nfc_hci_recv_frame(struct nfc_hci_dev *hdev, struct sk_buff *skb);
 /* connecting to gates and sending hci instructions */
-int nfc_hci_connect_gate(struct nfc_hci_dev *hdev, u8 dest_host, u8 dest_gate);
+int nfc_hci_connect_gate(struct nfc_hci_dev *hdev, u8 dest_host, u8 dest_gate,
+                         u8 pipe);
 int nfc_hci_disconnect_gate(struct nfc_hci_dev *hdev, u8 gate);
 int nfc_hci_disconnect_all_gates(struct nfc_hci_dev *hdev);
 int nfc_hci_get_param(struct nfc_hci_dev *hdev, u8 gate, u8 idx,
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index 180964b954ab..6431f5e39022 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -204,4 +204,6 @@ int nfc_tm_activated(struct nfc_dev *dev, u32 protocol, u8 comm_mode,
 int nfc_tm_deactivated(struct nfc_dev *dev);
 int nfc_tm_data_received(struct nfc_dev *dev, struct sk_buff *skb);
+void nfc_driver_failure(struct nfc_dev *dev, int err);
 #endif /* __NET_NFC_H */
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index c2a2dcbfdf01..ccbe2413142a 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2668,8 +2668,8 @@ ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
                tf->u.setup_req.capability =
                        cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
-                ieee80211_add_srates_ie(&sdata->vif, skb, false);
+                ieee80211_add_srates_ie(sdata, skb, false);
-                ieee80211_add_ext_srates_ie(&sdata->vif, skb, false);
+                ieee80211_add_ext_srates_ie(sdata, skb, false);
                ieee80211_tdls_add_ext_capab(skb);
                break;
        case WLAN_TDLS_SETUP_RESPONSE:
@@ -2682,8 +2682,8 @@ ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
                tf->u.setup_resp.capability =
                        cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
-                ieee80211_add_srates_ie(&sdata->vif, skb, false);
+                ieee80211_add_srates_ie(sdata, skb, false);
-                ieee80211_add_ext_srates_ie(&sdata->vif, skb, false);
+                ieee80211_add_ext_srates_ie(sdata, skb, false);
                ieee80211_tdls_add_ext_capab(skb);
                break;
        case WLAN_TDLS_SETUP_CONFIRM:
@@ -2743,8 +2743,8 @@ ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev,
                mgmt->u.action.u.tdls_discover_resp.capability =
                        cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
-                ieee80211_add_srates_ie(&sdata->vif, skb, false);
+                ieee80211_add_srates_ie(sdata, skb, false);
-                ieee80211_add_ext_srates_ie(&sdata->vif, skb, false);
+                ieee80211_add_ext_srates_ie(sdata, skb, false);
                ieee80211_tdls_add_ext_capab(skb);
                break;
        default:
@@ -2980,14 +2980,14 @@ static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
        return 0;
 }
-static struct ieee80211_channel *
+static void ieee80211_set_monitor_enabled(struct wiphy *wiphy, bool enabled)
-ieee80211_wiphy_get_channel(struct wiphy *wiphy,
-                            enum nl80211_channel_type *type)
 {
        struct ieee80211_local *local = wiphy_priv(wiphy);
-        *type = local->_oper_channel_type;
+        if (enabled)
-        return local->oper_channel;
+                WARN_ON(ieee80211_add_virtual_monitor(local));
+        else
+                ieee80211_del_virtual_monitor(local);
 }
 #ifdef CONFIG_PM
@@ -3063,8 +3063,8 @@ struct cfg80211_ops mac80211_config_ops = {
        .tdls_oper = ieee80211_tdls_oper,
        .tdls_mgmt = ieee80211_tdls_mgmt,
        .probe_client = ieee80211_probe_client,
-        .get_channel = ieee80211_wiphy_get_channel,
        .set_noack_map = ieee80211_set_noack_map,
+        .set_monitor_enabled = ieee80211_set_monitor_enabled,
 #ifdef CONFIG_PM
        .set_wakeup = ieee80211_set_wakeup,
 #endif
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 7932767bb482..090d08ff22c4 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -283,6 +283,11 @@ void ieee80211_debugfs_key_update_default(struct ieee80211_sub_if_data *sdata)
        lockdep_assert_held(&sdata->local->key_mtx);
+        if (sdata->debugfs.default_unicast_key) {
+                debugfs_remove(sdata->debugfs.default_unicast_key);
+                sdata->debugfs.default_unicast_key = NULL;
+        }
        if (sdata->default_unicast_key) {
                key = key_mtx_dereference(sdata->local,
                                          sdata->default_unicast_key);
@@ -290,9 +295,11 @@ void ieee80211_debugfs_key_update_default(struct ieee80211_sub_if_data *sdata)
                sdata->debugfs.default_unicast_key =
                        debugfs_create_symlink("default_unicast_key",
                                               sdata->debugfs.dir, buf);
-        } else {
+        }
-                debugfs_remove(sdata->debugfs.default_unicast_key);
-                sdata->debugfs.default_unicast_key = NULL;
+        if (sdata->debugfs.default_multicast_key) {
+                debugfs_remove(sdata->debugfs.default_multicast_key);
+                sdata->debugfs.default_multicast_key = NULL;
        }
        if (sdata->default_multicast_key) {
@@ -302,9 +309,6 @@ void ieee80211_debugfs_key_update_default(struct ieee80211_sub_if_data *sdata)
                sdata->debugfs.default_multicast_key =
                        debugfs_create_symlink("default_multicast_key",
                                               sdata->debugfs.dir, buf);
-        } else {
-                debugfs_remove(sdata->debugfs.default_multicast_key);
-                sdata->debugfs.default_multicast_key = NULL;
        }
 }
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 44e8c1242781..df9203199102 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -27,14 +27,6 @@ static inline void drv_tx(struct ieee80211_local *local, struct sk_buff *skb)
        local->ops->tx(&local->hw, skb);
 }
-static inline void drv_tx_frags(struct ieee80211_local *local,
-                                struct ieee80211_vif *vif,
-                                struct ieee80211_sta *sta,
-                                struct sk_buff_head *skbs)
-{
-        local->ops->tx_frags(&local->hw, vif, sta, skbs);
-}
 static inline void drv_get_et_strings(struct ieee80211_sub_if_data *sdata,
                                      u32 sset, u8 *data)
 {
@@ -860,4 +852,18 @@ static inline int drv_get_rssi(struct ieee80211_local *local,
        return ret;
 }
+static inline void drv_mgd_prepare_tx(struct ieee80211_local *local,
+                                      struct ieee80211_sub_if_data *sdata)
+{
+        might_sleep();
+        check_sdata_in_driver(sdata);
+        WARN_ON_ONCE(sdata->vif.type != NL80211_IFTYPE_STATION);
+        trace_drv_mgd_prepare_tx(local, sdata);
+        if (local->ops->mgd_prepare_tx)
+                local->ops->mgd_prepare_tx(&local->hw, &sdata->vif);
+        trace_drv_return_void(local);
+}
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index f834a005e1c5..e0423f8c0ce1 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1284,7 +1284,6 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
                             enum nl80211_iftype type);
 void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata);
 void ieee80211_remove_interfaces(struct ieee80211_local *local);
-u32 __ieee80211_recalc_idle(struct ieee80211_local *local);
 void ieee80211_recalc_idle(struct ieee80211_local *local);
 void ieee80211_adjust_monitor_flags(struct ieee80211_sub_if_data *sdata,
                                    const int offset);
@@ -1481,6 +1480,16 @@ u8 *ieee80211_ie_build_ht_oper(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
                               struct ieee80211_channel *channel,
                               enum nl80211_channel_type channel_type,
                               u16 prot_mode);
+u8 *ieee80211_ie_build_vht_cap(u8 *pos, struct ieee80211_sta_vht_cap *vht_cap,
+                               u32 cap);
+int ieee80211_add_srates_ie(struct ieee80211_sub_if_data *sdata,
+                            struct sk_buff *skb, bool need_basic);
+int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
+                                struct sk_buff *skb, bool need_basic);
+/* virtual monitor */
+int ieee80211_add_virtual_monitor(struct ieee80211_local *local);
+void ieee80211_del_virtual_monitor(struct ieee80211_local *local);
 /* channel management */
 enum ieee80211_chan_mode {
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 58c2ab3d483a..fbef7a1ada7a 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -43,6 +43,127 @@
 */
+static u32 ieee80211_idle_off(struct ieee80211_local *local,
+                              const char *reason)
+{
+        if (!(local->hw.conf.flags & IEEE80211_CONF_IDLE))
+                return 0;
+        local->hw.conf.flags &= ~IEEE80211_CONF_IDLE;
+        return IEEE80211_CONF_CHANGE_IDLE;
+}
+static u32 ieee80211_idle_on(struct ieee80211_local *local)
+{
+        if (local->hw.conf.flags & IEEE80211_CONF_IDLE)
+                return 0;
+        drv_flush(local, false);
+        local->hw.conf.flags |= IEEE80211_CONF_IDLE;
+        return IEEE80211_CONF_CHANGE_IDLE;
+}
+static u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+        int count = 0;
+        bool working = false, scanning = false;
+        unsigned int led_trig_start = 0, led_trig_stop = 0;
+        struct ieee80211_roc_work *roc;
+#ifdef CONFIG_PROVE_LOCKING
+        WARN_ON(debug_locks && !lockdep_rtnl_is_held() &&
+                !lockdep_is_held(&local->iflist_mtx));
+#endif
+        lockdep_assert_held(&local->mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!ieee80211_sdata_running(sdata)) {
+                        sdata->vif.bss_conf.idle = true;
+                        continue;
+                }
+                sdata->old_idle = sdata->vif.bss_conf.idle;
+                /* do not count disabled managed interfaces */
+                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+                    !sdata->u.mgd.associated &&
+                    !sdata->u.mgd.auth_data &&
+                    !sdata->u.mgd.assoc_data) {
+                        sdata->vif.bss_conf.idle = true;
+                        continue;
+                }
+                /* do not count unused IBSS interfaces */
+                if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
+                    !sdata->u.ibss.ssid_len) {
+                        sdata->vif.bss_conf.idle = true;
+                        continue;
+                }
+                /* count everything else */
+                sdata->vif.bss_conf.idle = false;
+                count++;
+        }
+        if (!local->ops->remain_on_channel) {
+                list_for_each_entry(roc, &local->roc_list, list) {
+                        working = true;
+                        roc->sdata->vif.bss_conf.idle = false;
+                }
+        }
+        if (local->scan_sdata &&
+            !(local->hw.flags & IEEE80211_HW_SCAN_WHILE_IDLE)) {
+                scanning = true;
+                local->scan_sdata->vif.bss_conf.idle = false;
+        }
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                        continue;
+                if (sdata->old_idle == sdata->vif.bss_conf.idle)
+                        continue;
+                if (!ieee80211_sdata_running(sdata))
+                        continue;
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IDLE);
+        }
+        if (working || scanning)
+                led_trig_start |= IEEE80211_TPT_LEDTRIG_FL_WORK;
+        else
+                led_trig_stop |= IEEE80211_TPT_LEDTRIG_FL_WORK;
+        if (count)
+                led_trig_start |= IEEE80211_TPT_LEDTRIG_FL_CONNECTED;
+        else
+                led_trig_stop |= IEEE80211_TPT_LEDTRIG_FL_CONNECTED;
+        ieee80211_mod_tpt_led_trig(local, led_trig_start, led_trig_stop);
+        if (working)
+                return ieee80211_idle_off(local, "working");
+        if (scanning)
+                return ieee80211_idle_off(local, "scanning");
+        if (!count)
+                return ieee80211_idle_on(local);
+        else
+                return ieee80211_idle_off(local, "in use");
+        return 0;
+}
+void ieee80211_recalc_idle(struct ieee80211_local *local)
+{
+        u32 chg;
+        mutex_lock(&local->iflist_mtx);
+        chg = __ieee80211_recalc_idle(local);
+        mutex_unlock(&local->iflist_mtx);
+        if (chg)
+                ieee80211_hw_config(local, chg);
+}
 static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
 {
        int meshhdrlen;
@@ -209,7 +330,7 @@ static void ieee80211_set_default_queues(struct ieee80211_sub_if_data *sdata)
        sdata->vif.cab_queue = IEEE80211_INVAL_HW_QUEUE;
 }
-static int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
+int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
 {
        struct ieee80211_sub_if_data *sdata;
        int ret;
@@ -250,7 +371,7 @@ static int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
        return 0;
 }
-static void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
+void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
 {
        struct ieee80211_sub_if_data *sdata;
@@ -366,12 +487,6 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                        break;
                }
-                if (local->monitors == 0 && local->open_count == 0) {
-                        res = ieee80211_add_virtual_monitor(local);
-                        if (res)
-                                goto err_stop;
-                }
                /* must be before the call to ieee80211_configure_filter */
                local->monitors++;
                if (local->monitors == 1) {
@@ -386,8 +501,6 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                break;
        default:
                if (coming_up) {
-                        ieee80211_del_virtual_monitor(local);
                        res = drv_add_interface(local, sdata);
                        if (res)
                                goto err_stop;
@@ -622,7 +735,6 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                if (local->monitors == 0) {
                        local->hw.conf.flags &= ~IEEE80211_CONF_MONITOR;
                        hw_reconf_flags |= IEEE80211_CONF_CHANGE_MONITOR;
-                        ieee80211_del_virtual_monitor(local);
                }
                ieee80211_adjust_monitor_flags(sdata, -1);
@@ -696,9 +808,6 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                }
        }
        spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
-        if (local->monitors == local->open_count && local->monitors > 0)
-                ieee80211_add_virtual_monitor(local);
 }
 static int ieee80211_stop(struct net_device *dev)
@@ -1403,127 +1512,6 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
        list_del(&unreg_list);
 }
-static u32 ieee80211_idle_off(struct ieee80211_local *local,
-                              const char *reason)
-{
-        if (!(local->hw.conf.flags & IEEE80211_CONF_IDLE))
-                return 0;
-        local->hw.conf.flags &= ~IEEE80211_CONF_IDLE;
-        return IEEE80211_CONF_CHANGE_IDLE;
-}
-static u32 ieee80211_idle_on(struct ieee80211_local *local)
-{
-        if (local->hw.conf.flags & IEEE80211_CONF_IDLE)
-                return 0;
-        drv_flush(local, false);
-        local->hw.conf.flags |= IEEE80211_CONF_IDLE;
-        return IEEE80211_CONF_CHANGE_IDLE;
-}
-u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
-{
-        struct ieee80211_sub_if_data *sdata;
-        int count = 0;
-        bool working = false, scanning = false;
-        unsigned int led_trig_start = 0, led_trig_stop = 0;
-        struct ieee80211_roc_work *roc;
-#ifdef CONFIG_PROVE_LOCKING
-        WARN_ON(debug_locks && !lockdep_rtnl_is_held() &&
-                !lockdep_is_held(&local->iflist_mtx));
-#endif
-        lockdep_assert_held(&local->mtx);
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!ieee80211_sdata_running(sdata)) {
-                        sdata->vif.bss_conf.idle = true;
-                        continue;
-                }
-                sdata->old_idle = sdata->vif.bss_conf.idle;
-                /* do not count disabled managed interfaces */
-                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                    !sdata->u.mgd.associated &&
-                    !sdata->u.mgd.auth_data &&
-                    !sdata->u.mgd.assoc_data) {
-                        sdata->vif.bss_conf.idle = true;
-                        continue;
-                }
-                /* do not count unused IBSS interfaces */
-                if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
-                    !sdata->u.ibss.ssid_len) {
-                        sdata->vif.bss_conf.idle = true;
-                        continue;
-                }
-                /* count everything else */
-                sdata->vif.bss_conf.idle = false;
-                count++;
-        }
-        if (!local->ops->remain_on_channel) {
-                list_for_each_entry(roc, &local->roc_list, list) {
-                        working = true;
-                        roc->sdata->vif.bss_conf.idle = false;
-                }
-        }
-        if (local->scan_sdata &&
-            !(local->hw.flags & IEEE80211_HW_SCAN_WHILE_IDLE)) {
-                scanning = true;
-                local->scan_sdata->vif.bss_conf.idle = false;
-        }
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
-                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                        continue;
-                if (sdata->old_idle == sdata->vif.bss_conf.idle)
-                        continue;
-                if (!ieee80211_sdata_running(sdata))
-                        continue;
-                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IDLE);
-        }
-        if (working || scanning)
-                led_trig_start |= IEEE80211_TPT_LEDTRIG_FL_WORK;
-        else
-                led_trig_stop |= IEEE80211_TPT_LEDTRIG_FL_WORK;
-        if (count)
-                led_trig_start |= IEEE80211_TPT_LEDTRIG_FL_CONNECTED;
-        else
-                led_trig_stop |= IEEE80211_TPT_LEDTRIG_FL_CONNECTED;
-        ieee80211_mod_tpt_led_trig(local, led_trig_start, led_trig_stop);
-        if (working)
-                return ieee80211_idle_off(local, "working");
-        if (scanning)
-                return ieee80211_idle_off(local, "scanning");
-        if (!count)
-                return ieee80211_idle_on(local);
-        else
-                return ieee80211_idle_off(local, "in use");
-        return 0;
-}
-void ieee80211_recalc_idle(struct ieee80211_local *local)
-{
-        u32 chg;
-        mutex_lock(&local->iflist_mtx);
-        chg = __ieee80211_recalc_idle(local);
-        mutex_unlock(&local->iflist_mtx);
-        if (chg)
-                ieee80211_hw_config(local, chg);
-}
 static int netdev_notify(struct notifier_block *nb,
                         unsigned long state,
                         void *ndev)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 0b040fb73673..c794101f8987 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -587,7 +587,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
        local->hw.priv = (char *)local + ALIGN(sizeof(*local), NETDEV_ALIGN);
-        BUG_ON(!ops->tx && !ops->tx_frags);
+        BUG_ON(!ops->tx);
        BUG_ON(!ops->start);
        BUG_ON(!ops->stop);
        BUG_ON(!ops->config);
@@ -688,7 +688,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
        int result, i;
        enum ieee80211_band band;
        int channels, max_bitrates;
-        bool supp_ht;
+        bool supp_ht, supp_vht;
        netdev_features_t feature_whitelist;
        static const u32 cipher_suites[] = {
                /* keep WEP first, it may be removed below */
@@ -706,12 +706,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
             local->hw.offchannel_tx_hw_queue >= local->hw.queues))
                return -EINVAL;
-        if ((hw->wiphy->wowlan.flags || hw->wiphy->wowlan.n_patterns)
 #ifdef CONFIG_PM
-            && (!local->ops->suspend || !local->ops->resume)
+        if ((hw->wiphy->wowlan.flags || hw->wiphy->wowlan.n_patterns) &&
-#endif
+            (!local->ops->suspend || !local->ops->resume))
-            )
                return -EINVAL;
+#endif
        if ((hw->flags & IEEE80211_HW_SCAN_WHILE_IDLE) && !local->ops->hw_scan)
                return -EINVAL;
@@ -733,6 +732,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
        channels = 0;
        max_bitrates = 0;
        supp_ht = false;
+        supp_vht = false;
        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                struct ieee80211_supported_band *sband;
@@ -750,6 +750,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                if (max_bitrates < sband->n_bitrates)
                        max_bitrates = sband->n_bitrates;
                supp_ht = supp_ht || sband->ht_cap.ht_supported;
+                supp_vht = supp_vht || sband->vht_cap.vht_supported;
        }
        local->int_scan_req = kzalloc(sizeof(*local->int_scan_req) +
@@ -825,6 +826,10 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
        if (supp_ht)
                local->scan_ies_len += 2 + sizeof(struct ieee80211_ht_cap);
+        if (supp_vht)
+                local->scan_ies_len +=
+                        2 + sizeof(struct ieee80211_vht_capabilities);
        if (!local->ops->hw_scan) {
                /* For hw_scan, driver needs to set these up. */
                local->hw.wiphy->max_scan_ssids = 4;
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 9ad74dd87a7b..af671b984df3 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -258,8 +258,8 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                        pos = skb_put(skb, 2);
                        memcpy(pos + 2, &plid, 2);
                }
-                if (ieee80211_add_srates_ie(&sdata->vif, skb, true) ||
+                if (ieee80211_add_srates_ie(sdata, skb, true) ||
-                    ieee80211_add_ext_srates_ie(&sdata->vif, skb, true) ||
+                    ieee80211_add_ext_srates_ie(sdata, skb, true) ||
                    mesh_add_rsn_ie(skb, sdata) ||
                    mesh_add_meshid_ie(skb, sdata) ||
                    mesh_add_meshconf_ie(skb, sdata))
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index aa69a331f374..f49f14f8ba82 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -541,6 +541,8 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                memcpy(pos, assoc_data->ie + offset, noffset - offset);
        }
+        drv_mgd_prepare_tx(local, sdata);
        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
        ieee80211_tx_skb(sdata, skb);
 }
@@ -580,6 +582,9 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
                if (!(ifmgd->flags & IEEE80211_STA_MFP_ENABLED))
                        IEEE80211_SKB_CB(skb)->flags |=
                                IEEE80211_TX_INTFL_DONT_ENCRYPT;
+                drv_mgd_prepare_tx(local, sdata);
                ieee80211_tx_skb(sdata, skb);
        }
 }
@@ -902,9 +907,6 @@ static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
        if (!mgd->associated)
                return false;
-        if (!mgd->associated->beacon_ies)
-                return false;
        if (mgd->flags & (IEEE80211_STA_BEACON_POLL |
                          IEEE80211_STA_CONNECTION_POLL))
                return false;
@@ -1362,6 +1364,10 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
        }
        mutex_unlock(&local->sta_mtx);
+        /* flush out any pending frame (e.g. DELBA) before deauth/disassoc */
+        if (tx)
+                drv_flush(local, false);
        /* deauthenticate/disassociate now */
        if (tx || frame_buf)
                ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
@@ -1610,6 +1616,7 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
 {
        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct cfg80211_bss *cbss;
        struct sk_buff *skb;
        const u8 *ssid;
        int ssid_len;
@@ -1619,16 +1626,22 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
        ASSERT_MGD_MTX(ifmgd);
-        if (!ifmgd->associated)
+        if (ifmgd->associated)
+                cbss = ifmgd->associated;
+        else if (ifmgd->auth_data)
+                cbss = ifmgd->auth_data->bss;
+        else if (ifmgd->assoc_data)
+                cbss = ifmgd->assoc_data->bss;
+        else
                return NULL;
-        ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
+        ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
        if (WARN_ON_ONCE(ssid == NULL))
                ssid_len = 0;
        else
                ssid_len = ssid[1];
-        skb = ieee80211_build_probe_req(sdata, ifmgd->associated->bssid,
+        skb = ieee80211_build_probe_req(sdata, cbss->bssid,
                                        (u32) -1, ssid + 2, ssid_len,
                                        NULL, 0, true);
@@ -1747,6 +1760,7 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
        if (!elems.challenge)
                return;
        auth_data->expected_transaction = 4;
+        drv_mgd_prepare_tx(sdata->local, sdata);
        ieee80211_send_auth(sdata, 3, auth_data->algorithm,
                            elems.challenge - 2, elems.challenge_len + 2,
                            auth_data->bss->bssid, auth_data->bss->bssid,
@@ -2630,6 +2644,8 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
                return -ETIMEDOUT;
        }
+        drv_mgd_prepare_tx(local, sdata);
        if (auth_data->bss->proberesp_ies) {
                sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
                           auth_data->bss->bssid, auth_data->tries,
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index 2e60f4acd027..e1e9d10ec2e7 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -1244,6 +1244,13 @@ TRACE_EVENT(drv_get_rssi,
        )
 );
+DEFINE_EVENT(local_sdata_evt, drv_mgd_prepare_tx,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata),
+        TP_ARGS(local, sdata)
+);
 /*
 * Tracing for API calls that drivers call.
 */
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index ec8f53467374..c9d2175d15c1 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -140,6 +140,8 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
                        if (r->flags & IEEE80211_RATE_MANDATORY_A)
                                mrate = r->bitrate;
                        break;
+                case IEEE80211_BAND_60GHZ:
+                        /* TODO, for now fall through */
                case IEEE80211_NUM_BANDS:
                        WARN_ON(1);
                        break;
@@ -957,8 +959,7 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
                        info->control.rates[1].idx = -1;
                        info->control.rates[2].idx = -1;
                        info->control.rates[3].idx = -1;
-                        info->control.rates[4].idx = -1;
+                        BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 4);
-                        BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 5);
                        info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
                } else {
                        hdr->frame_control &= ~morefrags;
@@ -1293,11 +1294,8 @@ static bool __ieee80211_tx(struct ieee80211_local *local,
                break;
        }
-        if (local->ops->tx_frags)
+        result = ieee80211_tx_frags(local, vif, pubsta, skbs,
-                drv_tx_frags(local, vif, pubsta, skbs);
+                                    txpending);
-        else
-                result = ieee80211_tx_frags(local, vif, pubsta, skbs,
-                                            txpending);
        ieee80211_tpt_led_trig_tx(local, fc, led_len);
        ieee80211_led_tx(local, 1);
@@ -2420,9 +2418,9 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                *pos++ = WLAN_EID_SSID;
                *pos++ = 0x0;
-                if (ieee80211_add_srates_ie(&sdata->vif, skb, true) ||
+                if (ieee80211_add_srates_ie(sdata, skb, true) ||
                    mesh_add_ds_params_ie(skb, sdata) ||
-                    ieee80211_add_ext_srates_ie(&sdata->vif, skb, true) ||
+                    ieee80211_add_ext_srates_ie(sdata, skb, true) ||
                    mesh_add_rsn_ie(skb, sdata) ||
                    mesh_add_ht_cap_ie(skb, sdata) ||
                    mesh_add_ht_oper_ie(skb, sdata) ||
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 242ecde381f6..64493a7bef1a 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -268,6 +268,10 @@ EXPORT_SYMBOL(ieee80211_ctstoself_duration);
 void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue)
 {
        struct ieee80211_sub_if_data *sdata;
+        int n_acs = IEEE80211_NUM_ACS;
+        if (local->hw.queues < IEEE80211_NUM_ACS)
+                n_acs = 1;
        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                int ac;
@@ -279,7 +283,7 @@ void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue)
                    local->queue_stop_reasons[sdata->vif.cab_queue] != 0)
                        continue;
-                for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                for (ac = 0; ac < n_acs; ac++) {
                        int ac_queue = sdata->vif.hw_queue[ac];
                        if (ac_queue == queue ||
@@ -341,6 +345,7 @@ static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
 {
        struct ieee80211_local *local = hw_to_local(hw);
        struct ieee80211_sub_if_data *sdata;
+        int n_acs = IEEE80211_NUM_ACS;
        trace_stop_queue(local, queue, reason);
@@ -352,11 +357,14 @@ static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
        __set_bit(reason, &local->queue_stop_reasons[queue]);
+        if (local->hw.queues < IEEE80211_NUM_ACS)
+                n_acs = 1;
        rcu_read_lock();
        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                int ac;
-                for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                for (ac = 0; ac < n_acs; ac++) {
                        if (sdata->vif.hw_queue[ac] == queue ||
                            sdata->vif.cab_queue == queue)
                                netif_stop_subqueue(sdata->dev, ac);
@@ -1072,6 +1080,10 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                pos += noffset - offset;
        }
+        if (sband->vht_cap.vht_supported)
+                pos = ieee80211_ie_build_vht_cap(pos, &sband->vht_cap,
+                                                 sband->vht_cap.cap);
        return pos - buffer;
 }
@@ -1411,10 +1423,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                if (ieee80211_sdata_running(sdata))
                        ieee80211_enable_keys(sdata);
+ wake_up:
        local->in_reconfig = false;
        barrier();
- wake_up:
        /*
         * Clear the WLAN_STA_BLOCK_BA flag so new aggregation
         * sessions can be established after a resume.
@@ -1699,6 +1711,27 @@ u8 *ieee80211_ie_build_ht_cap(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
        return pos;
 }
+u8 *ieee80211_ie_build_vht_cap(u8 *pos, struct ieee80211_sta_vht_cap *vht_cap,
+                                                           u32 cap)
+{
+        __le32 tmp;
+        *pos++ = WLAN_EID_VHT_CAPABILITY;
+        *pos++ = sizeof(struct ieee80211_vht_capabilities);
+        memset(pos, 0, sizeof(struct ieee80211_vht_capabilities));
+        /* capability flags */
+        tmp = cpu_to_le32(cap);
+        memcpy(pos, &tmp, sizeof(u32));
+        pos += sizeof(u32);
+        /* VHT MCS set */
+        memcpy(pos, &vht_cap->vht_mcs, sizeof(vht_cap->vht_mcs));
+        pos += sizeof(vht_cap->vht_mcs);
+        return pos;
+}
 u8 *ieee80211_ie_build_ht_oper(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
                               struct ieee80211_channel *channel,
                               enum nl80211_channel_type channel_type,
@@ -1764,15 +1797,14 @@ ieee80211_ht_oper_to_channel_type(struct ieee80211_ht_operation *ht_oper)
        return channel_type;
 }
-int ieee80211_add_srates_ie(struct ieee80211_vif *vif,
+int ieee80211_add_srates_ie(struct ieee80211_sub_if_data *sdata,
                            struct sk_buff *skb, bool need_basic)
 {
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
        struct ieee80211_local *local = sdata->local;
        struct ieee80211_supported_band *sband;
        int rate;
        u8 i, rates, *pos;
-        u32 basic_rates = vif->bss_conf.basic_rates;
+        u32 basic_rates = sdata->vif.bss_conf.basic_rates;
        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
        rates = sband->n_bitrates;
@@ -1796,15 +1828,14 @@ int ieee80211_add_srates_ie(struct ieee80211_vif *vif,
        return 0;
 }
-int ieee80211_add_ext_srates_ie(struct ieee80211_vif *vif,
+int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
                                struct sk_buff *skb, bool need_basic)
 {
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
        struct ieee80211_local *local = sdata->local;
        struct ieee80211_supported_band *sband;
        int rate;
        u8 i, exrates, *pos;
-        u32 basic_rates = vif->bss_conf.basic_rates;
+        u32 basic_rates = sdata->vif.bss_conf.basic_rates;
        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
        exrates = sband->n_bitrates;
diff --git a/net/nfc/core.c b/net/nfc/core.c
index 4177bb5104b9..ff749794bc5b 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -29,6 +29,8 @@
 #include <linux/slab.h>
 #include <linux/nfc.h>
+#include <net/genetlink.h>
 #include "nfc.h"
 #define VERSION "0.1"
@@ -560,6 +562,8 @@ EXPORT_SYMBOL(nfc_alloc_recv_skb);
 * The device driver must call this function when one or many nfc targets
 * are found. After calling this function, the device driver must stop
 * polling for targets.
+ * NOTE: This function can be called with targets=NULL and n_targets=0 to
+ * notify a driver error, meaning that the polling operation cannot complete.
 * IMPORTANT: this function must not be called from an atomic context.
 * In addition, it must also not be called from a context that would prevent
 * the NFC Core to call other nfc ops entry point concurrently.
@@ -571,23 +575,33 @@ int nfc_targets_found(struct nfc_dev *dev,
        pr_debug("dev_name=%s n_targets=%d\n", dev_name(&dev->dev), n_targets);
-        dev->polling = false;
        for (i = 0; i < n_targets; i++)
                targets[i].idx = dev->target_next_idx++;
        device_lock(&dev->dev);
+        if (dev->polling == false) {
+                device_unlock(&dev->dev);
+                return 0;
+        }
+        dev->polling = false;
        dev->targets_generation++;
        kfree(dev->targets);
-        dev->targets = kmemdup(targets, n_targets * sizeof(struct nfc_target),
+        dev->targets = NULL;
-                               GFP_ATOMIC);
-        if (!dev->targets) {
+        if (targets) {
-                dev->n_targets = 0;
+                dev->targets = kmemdup(targets,
-                device_unlock(&dev->dev);
+                                       n_targets * sizeof(struct nfc_target),
-                return -ENOMEM;
+                                       GFP_ATOMIC);
+                if (!dev->targets) {
+                        dev->n_targets = 0;
+                        device_unlock(&dev->dev);
+                        return -ENOMEM;
+                }
        }
        dev->n_targets = n_targets;
@@ -651,6 +665,12 @@ int nfc_target_lost(struct nfc_dev *dev, u32 target_idx)
 }
 EXPORT_SYMBOL(nfc_target_lost);
+inline void nfc_driver_failure(struct nfc_dev *dev, int err)
+{
+        nfc_targets_found(dev, NULL, 0);
+}
+EXPORT_SYMBOL(nfc_driver_failure);
 static void nfc_release(struct device *d)
 {
        struct nfc_dev *dev = to_nfc_dev(d);
@@ -906,3 +926,5 @@ MODULE_AUTHOR("Lauro Ramos Venancio <lauro.venancio@openbossa.org>");
 MODULE_DESCRIPTION("NFC Core ver " VERSION);
 MODULE_VERSION(VERSION);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS_NETPROTO(PF_NFC);
+MODULE_ALIAS_GENL_FAMILY(NFC_GENL_NAME);
diff --git a/net/nfc/hci/command.c b/net/nfc/hci/command.c
index 8729abf5f18b..46362ef979db 100644
--- a/net/nfc/hci/command.c
+++ b/net/nfc/hci/command.c
@@ -28,26 +28,14 @@
 #include "hci.h"
-static int nfc_hci_result_to_errno(u8 result)
+static void nfc_hci_execute_cb(struct nfc_hci_dev *hdev, int err,
-{
-        switch (result) {
-        case NFC_HCI_ANY_OK:
-                return 0;
-        case NFC_HCI_ANY_E_TIMEOUT:
-                return -ETIMEDOUT;
-        default:
-                return -1;
-        }
-}
-static void nfc_hci_execute_cb(struct nfc_hci_dev *hdev, u8 result,
                               struct sk_buff *skb, void *cb_data)
 {
        struct hcp_exec_waiter *hcp_ew = (struct hcp_exec_waiter *)cb_data;
-        pr_debug("HCI Cmd completed with HCI result=%d\n", result);
+        pr_debug("HCI Cmd completed with result=%d\n", err);
-        hcp_ew->exec_result = nfc_hci_result_to_errno(result);
+        hcp_ew->exec_result = err;
        if (hcp_ew->exec_result == 0)
                hcp_ew->result_skb = skb;
        else
@@ -311,9 +299,9 @@ int nfc_hci_disconnect_all_gates(struct nfc_hci_dev *hdev)
 }
 EXPORT_SYMBOL(nfc_hci_disconnect_all_gates);
-int nfc_hci_connect_gate(struct nfc_hci_dev *hdev, u8 dest_host, u8 dest_gate)
+int nfc_hci_connect_gate(struct nfc_hci_dev *hdev, u8 dest_host, u8 dest_gate,
+                         u8 pipe)
 {
-        u8 pipe = NFC_HCI_INVALID_PIPE;
        bool pipe_created = false;
        int r;
@@ -322,6 +310,9 @@ int nfc_hci_connect_gate(struct nfc_hci_dev *hdev, u8 dest_host, u8 dest_gate)
        if (hdev->gate2pipe[dest_gate] != NFC_HCI_INVALID_PIPE)
                return -EADDRINUSE;
+        if (pipe != NFC_HCI_INVALID_PIPE)
+                goto pipe_is_open;
        switch (dest_gate) {
        case NFC_HCI_LINK_MGMT_GATE:
                pipe = NFC_HCI_LINK_MGMT_PIPE;
@@ -347,6 +338,7 @@ int nfc_hci_connect_gate(struct nfc_hci_dev *hdev, u8 dest_host, u8 dest_gate)
                return r;
        }
+pipe_is_open:
        hdev->gate2pipe[dest_gate] = pipe;
        return 0;
diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
index a8b0b71e8f86..36717cebfbb6 100644
--- a/net/nfc/hci/core.c
+++ b/net/nfc/hci/core.c
@@ -32,6 +32,18 @@
 /* Largest headroom needed for outgoing HCI commands */
 #define HCI_CMDS_HEADROOM 1
+static int nfc_hci_result_to_errno(u8 result)
+{
+        switch (result) {
+        case NFC_HCI_ANY_OK:
+                return 0;
+        case NFC_HCI_ANY_E_TIMEOUT:
+                return -ETIME;
+        default:
+                return -1;
+        }
+}
 static void nfc_hci_msg_tx_work(struct work_struct *work)
 {
        struct nfc_hci_dev *hdev = container_of(work, struct nfc_hci_dev,
@@ -46,7 +58,7 @@ static void nfc_hci_msg_tx_work(struct work_struct *work)
                if (timer_pending(&hdev->cmd_timer) == 0) {
                        if (hdev->cmd_pending_msg->cb)
                                hdev->cmd_pending_msg->cb(hdev,
-                                                          NFC_HCI_ANY_E_TIMEOUT,
+                                                          -ETIME,
                                                          NULL,
                                                          hdev->
                                                          cmd_pending_msg->
@@ -71,8 +83,7 @@ next_msg:
                        kfree_skb(skb);
                        skb_queue_purge(&msg->msg_frags);
                        if (msg->cb)
-                                msg->cb(hdev, NFC_HCI_ANY_E_NOK, NULL,
+                                msg->cb(hdev, r, NULL, msg->cb_context);
-                                        msg->cb_context);
                        kfree(msg);
                        break;
                }
@@ -116,20 +127,13 @@ static void nfc_hci_msg_rx_work(struct work_struct *work)
        }
 }
-void nfc_hci_resp_received(struct nfc_hci_dev *hdev, u8 result,
+static void __nfc_hci_cmd_completion(struct nfc_hci_dev *hdev, int err,
-                           struct sk_buff *skb)
+                                     struct sk_buff *skb)
 {
-        mutex_lock(&hdev->msg_tx_mutex);
-        if (hdev->cmd_pending_msg == NULL) {
-                kfree_skb(skb);
-                goto exit;
-        }
        del_timer_sync(&hdev->cmd_timer);
        if (hdev->cmd_pending_msg->cb)
-                hdev->cmd_pending_msg->cb(hdev, result, skb,
+                hdev->cmd_pending_msg->cb(hdev, err, skb,
                                          hdev->cmd_pending_msg->cb_context);
        else
                kfree_skb(skb);
@@ -138,6 +142,19 @@ void nfc_hci_resp_received(struct nfc_hci_dev *hdev, u8 result,
        hdev->cmd_pending_msg = NULL;
        queue_work(hdev->msg_tx_wq, &hdev->msg_tx_work);
+}
+void nfc_hci_resp_received(struct nfc_hci_dev *hdev, u8 result,
+                           struct sk_buff *skb)
+{
+        mutex_lock(&hdev->msg_tx_mutex);
+        if (hdev->cmd_pending_msg == NULL) {
+                kfree_skb(skb);
+                goto exit;
+        }
+        __nfc_hci_cmd_completion(hdev, nfc_hci_result_to_errno(result), skb);
 exit:
        mutex_unlock(&hdev->msg_tx_mutex);
@@ -213,7 +230,7 @@ static int nfc_hci_target_discovered(struct nfc_hci_dev *hdev, u8 gate)
                }
                break;
        case NFC_HCI_RF_READER_B_GATE:
-                targets->supported_protocols = NFC_PROTO_ISO14443_MASK;
+                targets->supported_protocols = NFC_PROTO_ISO14443_B_MASK;
                break;
        default:
                if (hdev->ops->target_from_gate)
@@ -298,15 +315,15 @@ static void nfc_hci_cmd_timeout(unsigned long data)
 }
 static int hci_dev_connect_gates(struct nfc_hci_dev *hdev, u8 gate_count,
-                                 u8 gates[])
+                                 struct nfc_hci_gate *gates)
 {
        int r;
-        u8 *p = gates;
        while (gate_count--) {
-                r = nfc_hci_connect_gate(hdev, NFC_HCI_HOST_CONTROLLER_ID, *p);
+                r = nfc_hci_connect_gate(hdev, NFC_HCI_HOST_CONTROLLER_ID,
+                                         gates->gate, gates->pipe);
                if (r < 0)
                        return r;
-                p++;
+                gates++;
        }
        return 0;
@@ -316,14 +333,13 @@ static int hci_dev_session_init(struct nfc_hci_dev *hdev)
 {
        struct sk_buff *skb = NULL;
        int r;
-        u8 hci_gates[] = {      /* NFC_HCI_ADMIN_GATE MUST be first */
-                NFC_HCI_ADMIN_GATE, NFC_HCI_LOOPBACK_GATE,
+        if (hdev->init_data.gates[0].gate != NFC_HCI_ADMIN_GATE)
-                NFC_HCI_ID_MGMT_GATE, NFC_HCI_LINK_MGMT_GATE,
+                return -EPROTO;
-                NFC_HCI_RF_READER_B_GATE, NFC_HCI_RF_READER_A_GATE
-        };
        r = nfc_hci_connect_gate(hdev, NFC_HCI_HOST_CONTROLLER_ID,
-                                 NFC_HCI_ADMIN_GATE);
+                                 hdev->init_data.gates[0].gate,
+                                 hdev->init_data.gates[0].pipe);
        if (r < 0)
                goto exit;
@@ -351,10 +367,6 @@ static int hci_dev_session_init(struct nfc_hci_dev *hdev)
        if (r < 0)
                goto exit;
-        r = hci_dev_connect_gates(hdev, sizeof(hci_gates), hci_gates);
-        if (r < 0)
-                goto disconnect_all;
        r = hci_dev_connect_gates(hdev, hdev->init_data.gate_count,
                                  hdev->init_data.gates);
        if (r < 0)
@@ -717,6 +729,27 @@ void *nfc_hci_get_clientdata(struct nfc_hci_dev *hdev)
 }
 EXPORT_SYMBOL(nfc_hci_get_clientdata);
+static void nfc_hci_failure(struct nfc_hci_dev *hdev, int err)
+{
+        mutex_lock(&hdev->msg_tx_mutex);
+        if (hdev->cmd_pending_msg == NULL) {
+                nfc_driver_failure(hdev->ndev, err);
+                goto exit;
+        }
+        __nfc_hci_cmd_completion(hdev, err, NULL);
+exit:
+        mutex_unlock(&hdev->msg_tx_mutex);
+}
+void nfc_hci_driver_failure(struct nfc_hci_dev *hdev, int err)
+{
+        nfc_hci_failure(hdev, err);
+}
+EXPORT_SYMBOL(nfc_hci_driver_failure);
 void nfc_hci_recv_frame(struct nfc_hci_dev *hdev, struct sk_buff *skb)
 {
        struct hcp_packet *packet;
@@ -727,16 +760,6 @@ void nfc_hci_recv_frame(struct nfc_hci_dev *hdev, struct sk_buff *skb)
        struct sk_buff *frag_skb;
        int msg_len;
-        if (skb == NULL) {
-                /* TODO ELa: lower layer had permanent failure, need to
-                 * propagate that up
-                 */
-                skb_queue_purge(&hdev->rx_hcp_frags);
-                return;
-        }
        packet = (struct hcp_packet *)skb->data;
        if ((packet->header & ~NFC_HCI_FRAGMENT) == 0) {
                skb_queue_tail(&hdev->rx_hcp_frags, skb);
@@ -757,9 +780,8 @@ void nfc_hci_recv_frame(struct nfc_hci_dev *hdev, struct sk_buff *skb)
                hcp_skb = nfc_alloc_recv_skb(NFC_HCI_HCP_PACKET_HEADER_LEN +
                                             msg_len, GFP_KERNEL);
                if (hcp_skb == NULL) {
-                        /* TODO ELa: cannot deliver HCP message. How to
+                        nfc_hci_failure(hdev, -ENOMEM);
-                         * propagate error up?
+                        return;
-                         */
                }
                *skb_put(hcp_skb, NFC_HCI_HCP_PACKET_HEADER_LEN) = pipe;
diff --git a/net/nfc/hci/hci.h b/net/nfc/hci/hci.h
index 45f2fe4fd486..fa9a21e92239 100644
--- a/net/nfc/hci/hci.h
+++ b/net/nfc/hci/hci.h
@@ -37,10 +37,11 @@ struct hcp_packet {
 /*
 * HCI command execution completion callback.
- * result will be one of the HCI response codes.
+ * result will be a standard linux error (may be converted from HCI response)
- * skb contains the response data and must be disposed.
+ * skb contains the response data and must be disposed, or may be NULL if
+ * an error occured
 */
-typedef void (*hci_cmd_cb_t) (struct nfc_hci_dev *hdev, u8 result,
+typedef void (*hci_cmd_cb_t) (struct nfc_hci_dev *hdev, int result,
                              struct sk_buff *skb, void *cb_data);
 struct hcp_exec_waiter {
@@ -131,9 +132,4 @@ void nfc_hci_hcp_message_rx(struct nfc_hci_dev *hdev, u8 pipe, u8 type,
 #define NFC_HCI_ANY_E_REG_ACCESS_DENIED         0x0a
 #define NFC_HCI_ANY_E_PIPE_ACCESS_DENIED        0x0b
-/* Pipes */
-#define NFC_HCI_INVALID_PIPE    0x80
-#define NFC_HCI_LINK_MGMT_PIPE  0x00
-#define NFC_HCI_ADMIN_PIPE      0x01
 #endif /* __LOCAL_HCI_H */
diff --git a/net/nfc/hci/shdlc.c b/net/nfc/hci/shdlc.c
index 6b836e6242b7..6f840c18c892 100644
--- a/net/nfc/hci/shdlc.c
+++ b/net/nfc/hci/shdlc.c
@@ -340,15 +340,6 @@ static void nfc_shdlc_connect_complete(struct nfc_shdlc *shdlc, int r)
                shdlc->state = SHDLC_CONNECTED;
        } else {
                shdlc->state = SHDLC_DISCONNECTED;
-                /*
-                 * TODO: Could it be possible that there are pending
-                 * executing commands that are waiting for connect to complete
-                 * before they can be carried? As connect is a blocking
-                 * operation, it would require that the userspace process can
-                 * send commands on the same device from a second thread before
-                 * the device is up. I don't think that is possible, is it?
-                 */
        }
        shdlc->connect_result = r;
@@ -413,12 +404,12 @@ static void nfc_shdlc_rcv_u_frame(struct nfc_shdlc *shdlc,
                                r = nfc_shdlc_connect_send_ua(shdlc);
                                nfc_shdlc_connect_complete(shdlc, r);
                        }
-                } else if (shdlc->state > SHDLC_NEGOCIATING) {
+                } else if (shdlc->state == SHDLC_CONNECTED) {
                        /*
-                         * TODO: Chip wants to reset link
+                         * Chip wants to reset link. This is unexpected and
-                         * send ua, empty skb lists, reset counters
+                         * unsupported.
-                         * propagate info to HCI layer
                         */
+                        shdlc->hard_fault = -ECONNRESET;
                }
                break;
        case U_FRAME_UA:
@@ -523,10 +514,6 @@ static void nfc_shdlc_handle_send_queue(struct nfc_shdlc *shdlc)
                r = shdlc->ops->xmit(shdlc, skb);
                if (r < 0) {
-                        /*
-                         * TODO: Cannot send, shdlc machine is dead, we
-                         * must propagate the information up to HCI.
-                         */
                        shdlc->hard_fault = r;
                        break;
                }
@@ -590,6 +577,11 @@ static void nfc_shdlc_sm_work(struct work_struct *work)
                skb_queue_purge(&shdlc->ack_pending_q);
                break;
        case SHDLC_CONNECTING:
+                if (shdlc->hard_fault) {
+                        nfc_shdlc_connect_complete(shdlc, shdlc->hard_fault);
+                        break;
+                }
                if (shdlc->connect_tries++ < 5)
                        r = nfc_shdlc_connect_initiate(shdlc);
                else
@@ -610,6 +602,11 @@ static void nfc_shdlc_sm_work(struct work_struct *work)
                }
                nfc_shdlc_handle_rcv_queue(shdlc);
+                if (shdlc->hard_fault) {
+                        nfc_shdlc_connect_complete(shdlc, shdlc->hard_fault);
+                        break;
+                }
                break;
        case SHDLC_CONNECTED:
                nfc_shdlc_handle_rcv_queue(shdlc);
@@ -637,10 +634,7 @@ static void nfc_shdlc_sm_work(struct work_struct *work)
                }
                if (shdlc->hard_fault) {
-                        /*
+                        nfc_hci_driver_failure(shdlc->hdev, shdlc->hard_fault);
-                         * TODO: Handle hard_fault that occured during
-                         * this invocation of the shdlc worker
-                         */
                }
                break;
        default:
@@ -923,8 +917,6 @@ void nfc_shdlc_free(struct nfc_shdlc *shdlc)
 {
        pr_debug("\n");
-        /* TODO: Check that this cannot be called while still in use */
        nfc_hci_unregister_device(shdlc->hdev);
        nfc_hci_free_device(shdlc->hdev);
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c
index 5d503eeb15a1..82f0f7588b46 100644
--- a/net/nfc/llcp/llcp.c
+++ b/net/nfc/llcp/llcp.c
@@ -45,7 +45,7 @@ void nfc_llcp_sock_unlink(struct llcp_sock_list *l, struct sock *sk)
        write_unlock(&l->lock);
 }
-static void nfc_llcp_socket_release(struct nfc_llcp_local *local)
+static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen)
 {
        struct sock *sk;
        struct hlist_node *node, *tmp;
@@ -78,6 +78,11 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local)
                                sock_orphan(accept_sk);
                        }
+                        if (listen == true) {
+                                release_sock(sk);
+                                continue;
+                        }
                }
                sk->sk_state = LLCP_CLOSED;
@@ -106,7 +111,7 @@ static void local_release(struct kref *ref)
        local = container_of(ref, struct nfc_llcp_local, ref);
        list_del(&local->list);
-        nfc_llcp_socket_release(local);
+        nfc_llcp_socket_release(local, false);
        del_timer_sync(&local->link_timer);
        skb_queue_purge(&local->tx_queue);
        destroy_workqueue(local->tx_wq);
@@ -118,23 +123,48 @@ static void local_release(struct kref *ref)
 int nfc_llcp_local_put(struct nfc_llcp_local *local)
 {
-        WARN_ON(local == NULL);
        if (local == NULL)
                return 0;
        return kref_put(&local->ref, local_release);
 }
-static void nfc_llcp_clear_sdp(struct nfc_llcp_local *local)
+static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local,
+                                               u8 ssap, u8 dsap)
 {
-        mutex_lock(&local->sdp_lock);
+        struct sock *sk;
+        struct hlist_node *node;
+        struct nfc_llcp_sock *llcp_sock;
-        local->local_wks = 0;
+        pr_debug("ssap dsap %d %d\n", ssap, dsap);
-        local->local_sdp = 0;
-        local->local_sap = 0;
-        mutex_unlock(&local->sdp_lock);
+        if (ssap == 0 && dsap == 0)
+                return NULL;
+        read_lock(&local->sockets.lock);
+        llcp_sock = NULL;
+        sk_for_each(sk, node, &local->sockets.head) {
+                llcp_sock = nfc_llcp_sock(sk);
+                if (llcp_sock->ssap == ssap && llcp_sock->dsap == dsap)
+                        break;
+        }
+        read_unlock(&local->sockets.lock);
+        if (llcp_sock == NULL)
+                return NULL;
+        sock_hold(&llcp_sock->sk);
+        return llcp_sock;
+}
+static void nfc_llcp_sock_put(struct nfc_llcp_sock *sock)
+{
+        sock_put(&sock->sk);
 }
 static void nfc_llcp_timeout_work(struct work_struct *work)
@@ -197,6 +227,51 @@ static int nfc_llcp_wks_sap(char *service_name, size_t service_name_len)
        return -EINVAL;
 }
+static
+struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local,
+                                            u8 *sn, size_t sn_len)
+{
+        struct sock *sk;
+        struct hlist_node *node;
+        struct nfc_llcp_sock *llcp_sock, *tmp_sock;
+        pr_debug("sn %zd %p\n", sn_len, sn);
+        if (sn == NULL || sn_len == 0)
+                return NULL;
+        read_lock(&local->sockets.lock);
+        llcp_sock = NULL;
+        sk_for_each(sk, node, &local->sockets.head) {
+                tmp_sock = nfc_llcp_sock(sk);
+                pr_debug("llcp sock %p\n", tmp_sock);
+                if (tmp_sock->sk.sk_state != LLCP_LISTEN)
+                        continue;
+                if (tmp_sock->service_name == NULL ||
+                    tmp_sock->service_name_len == 0)
+                        continue;
+                if (tmp_sock->service_name_len != sn_len)
+                        continue;
+                if (memcmp(sn, tmp_sock->service_name, sn_len) == 0) {
+                        llcp_sock = tmp_sock;
+                        break;
+                }
+        }
+        read_unlock(&local->sockets.lock);
+        pr_debug("Found llcp sock %p\n", llcp_sock);
+        return llcp_sock;
+}
 u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local,
                         struct nfc_llcp_sock *sock)
 {
@@ -223,41 +298,26 @@ u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local,
                }
                /*
-                 * This is not a well known service,
+                 * Check if there already is a non WKS socket bound
-                 * we should try to find a local SDP free spot
+                 * to this service name.
                 */
-                ssap = find_first_zero_bit(&local->local_sdp, LLCP_SDP_NUM_SAP);
+                if (nfc_llcp_sock_from_sn(local, sock->service_name,
-                if (ssap == LLCP_SDP_NUM_SAP) {
+                                          sock->service_name_len) != NULL) {
                        mutex_unlock(&local->sdp_lock);
                        return LLCP_SAP_MAX;
                }
-                pr_debug("SDP ssap %d\n", LLCP_WKS_NUM_SAP + ssap);
-                set_bit(ssap, &local->local_sdp);
                mutex_unlock(&local->sdp_lock);
-                return LLCP_WKS_NUM_SAP + ssap;
+                return LLCP_SDP_UNBOUND;
-        } else if (sock->ssap != 0) {
-                if (sock->ssap < LLCP_WKS_NUM_SAP) {
-                        if (!test_bit(sock->ssap, &local->local_wks)) {
-                                set_bit(sock->ssap, &local->local_wks);
-                                mutex_unlock(&local->sdp_lock);
-                                return sock->ssap;
-                        }
-                } else if (sock->ssap < LLCP_SDP_NUM_SAP) {
+        } else if (sock->ssap != 0 && sock->ssap < LLCP_WKS_NUM_SAP) {
-                        if (!test_bit(sock->ssap - LLCP_WKS_NUM_SAP,
+                if (!test_bit(sock->ssap, &local->local_wks)) {
-                                      &local->local_sdp)) {
+                        set_bit(sock->ssap, &local->local_wks);
-                                set_bit(sock->ssap - LLCP_WKS_NUM_SAP,
+                        mutex_unlock(&local->sdp_lock);
-                                        &local->local_sdp);
-                                mutex_unlock(&local->sdp_lock);
-                                return sock->ssap;
+                        return sock->ssap;
-                        }
                }
        }
@@ -294,8 +354,34 @@ void nfc_llcp_put_ssap(struct nfc_llcp_local *local, u8 ssap)
                local_ssap = ssap;
                sdp = &local->local_wks;
        } else if (ssap < LLCP_LOCAL_NUM_SAP) {
+                atomic_t *client_cnt;
                local_ssap = ssap - LLCP_WKS_NUM_SAP;
                sdp = &local->local_sdp;
+                client_cnt = &local->local_sdp_cnt[local_ssap];
+                pr_debug("%d clients\n", atomic_read(client_cnt));
+                mutex_lock(&local->sdp_lock);
+                if (atomic_dec_and_test(client_cnt)) {
+                        struct nfc_llcp_sock *l_sock;
+                        pr_debug("No more clients for SAP %d\n", ssap);
+                        clear_bit(local_ssap, sdp);
+                        /* Find the listening sock and set it back to UNBOUND */
+                        l_sock = nfc_llcp_sock_get(local, ssap, LLCP_SAP_SDP);
+                        if (l_sock) {
+                                l_sock->ssap = LLCP_SDP_UNBOUND;
+                                nfc_llcp_sock_put(l_sock);
+                        }
+                }
+                mutex_unlock(&local->sdp_lock);
+                return;
        } else if (ssap < LLCP_MAX_SAP) {
                local_ssap = ssap - LLCP_LOCAL_NUM_SAP;
                sdp = &local->local_sap;
@@ -310,19 +396,26 @@ void nfc_llcp_put_ssap(struct nfc_llcp_local *local, u8 ssap)
        mutex_unlock(&local->sdp_lock);
 }
-u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len)
+static u8 nfc_llcp_reserve_sdp_ssap(struct nfc_llcp_local *local)
 {
-        struct nfc_llcp_local *local;
+        u8 ssap;
-        local = nfc_llcp_find_local(dev);
+        mutex_lock(&local->sdp_lock);
-        if (local == NULL) {
-                *general_bytes_len = 0;
+        ssap = find_first_zero_bit(&local->local_sdp, LLCP_SDP_NUM_SAP);
-                return NULL;
+        if (ssap == LLCP_SDP_NUM_SAP) {
+                mutex_unlock(&local->sdp_lock);
+                return LLCP_SAP_MAX;
        }
-        *general_bytes_len = local->gb_len;
+        pr_debug("SDP ssap %d\n", LLCP_WKS_NUM_SAP + ssap);
-        return local->gb;
+        set_bit(ssap, &local->local_sdp);
+        mutex_unlock(&local->sdp_lock);
+        return LLCP_WKS_NUM_SAP + ssap;
 }
 static int nfc_llcp_build_gb(struct nfc_llcp_local *local)
@@ -386,6 +479,23 @@ static int nfc_llcp_build_gb(struct nfc_llcp_local *local)
        return 0;
 }
+u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len)
+{
+        struct nfc_llcp_local *local;
+        local = nfc_llcp_find_local(dev);
+        if (local == NULL) {
+                *general_bytes_len = 0;
+                return NULL;
+        }
+        nfc_llcp_build_gb(local);
+        *general_bytes_len = local->gb_len;
+        return local->gb;
+}
 int nfc_llcp_set_remote_gb(struct nfc_dev *dev, u8 *gb, u8 gb_len)
 {
        struct nfc_llcp_local *local = nfc_llcp_find_local(dev);
@@ -509,74 +619,12 @@ out:
        return llcp_sock;
 }
-static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local,
-                                               u8 ssap, u8 dsap)
-{
-        struct sock *sk;
-        struct hlist_node *node;
-        struct nfc_llcp_sock *llcp_sock;
-        pr_debug("ssap dsap %d %d\n", ssap, dsap);
-        if (ssap == 0 && dsap == 0)
-                return NULL;
-        read_lock(&local->sockets.lock);
-        llcp_sock = NULL;
-        sk_for_each(sk, node, &local->sockets.head) {
-                llcp_sock = nfc_llcp_sock(sk);
-                if (llcp_sock->ssap == ssap &&
-                    llcp_sock->dsap == dsap)
-                        break;
-        }
-        read_unlock(&local->sockets.lock);
-        if (llcp_sock == NULL)
-                return NULL;
-        sock_hold(&llcp_sock->sk);
-        return llcp_sock;
-}
 static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local,
                                                  u8 *sn, size_t sn_len)
 {
-        struct sock *sk;
-        struct hlist_node *node;
        struct nfc_llcp_sock *llcp_sock;
-        pr_debug("sn %zd\n", sn_len);
+        llcp_sock = nfc_llcp_sock_from_sn(local, sn, sn_len);
-        if (sn == NULL || sn_len == 0)
-                return NULL;
-        read_lock(&local->sockets.lock);
-        llcp_sock = NULL;
-        sk_for_each(sk, node, &local->sockets.head) {
-                llcp_sock = nfc_llcp_sock(sk);
-                if (llcp_sock->sk.sk_state != LLCP_LISTEN)
-                        continue;
-                if (llcp_sock->service_name == NULL ||
-                    llcp_sock->service_name_len == 0)
-                        continue;
-                if (llcp_sock->service_name_len != sn_len)
-                        continue;
-                if (memcmp(sn, llcp_sock->service_name, sn_len) == 0)
-                        break;
-        }
-        read_unlock(&local->sockets.lock);
        if (llcp_sock == NULL)
                return NULL;
@@ -586,11 +634,6 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local,
        return llcp_sock;
 }
-static void nfc_llcp_sock_put(struct nfc_llcp_sock *sock)
-{
-        sock_put(&sock->sk);
-}
 static u8 *nfc_llcp_connect_sn(struct sk_buff *skb, size_t *sn_len)
 {
        u8 *tlv = &skb->data[2], type, length;
@@ -662,6 +705,21 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local,
                goto fail;
        }
+        if (sock->ssap == LLCP_SDP_UNBOUND) {
+                u8 ssap = nfc_llcp_reserve_sdp_ssap(local);
+                pr_debug("First client, reserving %d\n", ssap);
+                if (ssap == LLCP_SAP_MAX) {
+                        reason = LLCP_DM_REJ;
+                        release_sock(&sock->sk);
+                        sock_put(&sock->sk);
+                        goto fail;
+                }
+                sock->ssap = ssap;
+        }
        new_sk = nfc_llcp_sock_alloc(NULL, parent->sk_type, GFP_ATOMIC);
        if (new_sk == NULL) {
                reason = LLCP_DM_REJ;
@@ -675,9 +733,21 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local,
        new_sock->local = nfc_llcp_local_get(local);
        new_sock->miu = local->remote_miu;
        new_sock->nfc_protocol = sock->nfc_protocol;
-        new_sock->ssap = sock->ssap;
        new_sock->dsap = ssap;
+        new_sock->target_idx = local->target_idx;
        new_sock->parent = parent;
+        new_sock->ssap = sock->ssap;
+        if (sock->ssap < LLCP_LOCAL_NUM_SAP && sock->ssap >= LLCP_WKS_NUM_SAP) {
+                atomic_t *client_count;
+                pr_debug("reserved_ssap %d for %p\n", sock->ssap, new_sock);
+                client_count =
+                        &local->local_sdp_cnt[sock->ssap - LLCP_WKS_NUM_SAP];
+                atomic_inc(client_count);
+                new_sock->reserved_ssap = sock->ssap;
+        }
        nfc_llcp_parse_connection_tlv(new_sock, &skb->data[LLCP_HEADER_SIZE],
                                      skb->len - LLCP_HEADER_SIZE);
@@ -886,6 +956,45 @@ static void nfc_llcp_recv_cc(struct nfc_llcp_local *local, struct sk_buff *skb)
        nfc_llcp_sock_put(llcp_sock);
 }
+static void nfc_llcp_recv_dm(struct nfc_llcp_local *local, struct sk_buff *skb)
+{
+        struct nfc_llcp_sock *llcp_sock;
+        struct sock *sk;
+        u8 dsap, ssap, reason;
+        dsap = nfc_llcp_dsap(skb);
+        ssap = nfc_llcp_ssap(skb);
+        reason = skb->data[2];
+        pr_debug("%d %d reason %d\n", ssap, dsap, reason);
+        switch (reason) {
+        case LLCP_DM_NOBOUND:
+        case LLCP_DM_REJ:
+                llcp_sock = nfc_llcp_connecting_sock_get(local, dsap);
+                break;
+        default:
+                llcp_sock = nfc_llcp_sock_get(local, dsap, ssap);
+                break;
+        }
+        if (llcp_sock == NULL) {
+                pr_err("Invalid DM\n");
+                return;
+        }
+        sk = &llcp_sock->sk;
+        sk->sk_err = ENXIO;
+        sk->sk_state = LLCP_CLOSED;
+        sk->sk_state_change(sk);
+        nfc_llcp_sock_put(llcp_sock);
+        return;
+}
 static void nfc_llcp_rx_work(struct work_struct *work)
 {
        struct nfc_llcp_local *local = container_of(work, struct nfc_llcp_local,
@@ -929,6 +1038,11 @@ static void nfc_llcp_rx_work(struct work_struct *work)
                nfc_llcp_recv_cc(local, skb);
                break;
+        case LLCP_PDU_DM:
+                pr_debug("DM\n");
+                nfc_llcp_recv_dm(local, skb);
+                break;
        case LLCP_PDU_I:
        case LLCP_PDU_RR:
        case LLCP_PDU_RNR:
@@ -985,10 +1099,8 @@ void nfc_llcp_mac_is_down(struct nfc_dev *dev)
        if (local == NULL)
                return;
-        nfc_llcp_clear_sdp(local);
        /* Close and purge all existing sockets */
-        nfc_llcp_socket_release(local);
+        nfc_llcp_socket_release(local, true);
 }
 void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx,
diff --git a/net/nfc/llcp/llcp.h b/net/nfc/llcp/llcp.h
index 7286c86982ff..83b8bba5a280 100644
--- a/net/nfc/llcp/llcp.h
+++ b/net/nfc/llcp/llcp.h
@@ -37,6 +37,7 @@ enum llcp_state {
 #define LLCP_LOCAL_NUM_SAP 32
 #define LLCP_LOCAL_SAP_OFFSET (LLCP_WKS_NUM_SAP + LLCP_SDP_NUM_SAP)
 #define LLCP_MAX_SAP (LLCP_WKS_NUM_SAP + LLCP_SDP_NUM_SAP + LLCP_LOCAL_NUM_SAP)
+#define LLCP_SDP_UNBOUND   (LLCP_MAX_SAP + 1)
 struct nfc_llcp_sock;
@@ -69,6 +70,7 @@ struct nfc_llcp_local {
        unsigned long local_wks;      /* Well known services */
        unsigned long local_sdp;      /* Local services  */
        unsigned long local_sap; /* Local SAPs, not available for discovery */
+        atomic_t local_sdp_cnt[LLCP_SDP_NUM_SAP];
        /* local */
        u8 gb[NFC_MAX_GT_LEN];
@@ -113,6 +115,9 @@ struct nfc_llcp_sock {
        /* Is the remote peer ready to receive */
        u8 remote_ready;
+        /* Reserved source SAP */
+        u8 reserved_ssap;
        struct sk_buff_head tx_queue;
        struct sk_buff_head tx_pending_queue;
        struct sk_buff_head tx_backlog_queue;
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index 05ca5a680071..ddeb9aa398f0 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -78,11 +78,11 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
        struct sockaddr_nfc_llcp llcp_addr;
        int len, ret = 0;
-        pr_debug("sk %p addr %p family %d\n", sk, addr, addr->sa_family);
        if (!addr || addr->sa_family != AF_NFC)
                return -EINVAL;
+        pr_debug("sk %p addr %p family %d\n", sk, addr, addr->sa_family);
        memset(&llcp_addr, 0, sizeof(llcp_addr));
        len = min_t(unsigned int, sizeof(llcp_addr), alen);
        memcpy(&llcp_addr, addr, len);
@@ -121,8 +121,12 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
                                          GFP_KERNEL);
        llcp_sock->ssap = nfc_llcp_get_sdp_ssap(local, llcp_sock);
-        if (llcp_sock->ssap == LLCP_MAX_SAP)
+        if (llcp_sock->ssap == LLCP_SAP_MAX) {
+                ret = -EADDRINUSE;
                goto put_dev;
+        }
+        llcp_sock->reserved_ssap = llcp_sock->ssap;
        nfc_llcp_sock_link(&local->sockets, sk);
@@ -283,22 +287,28 @@ error:
        return ret;
 }
-static int llcp_sock_getname(struct socket *sock, struct sockaddr *addr,
+static int llcp_sock_getname(struct socket *sock, struct sockaddr *uaddr,
                             int *len, int peer)
 {
-        struct sockaddr_nfc_llcp *llcp_addr = (struct sockaddr_nfc_llcp *)addr;
        struct sock *sk = sock->sk;
        struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
+        DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, llcp_addr, uaddr);
-        pr_debug("%p\n", sk);
+        if (llcp_sock == NULL || llcp_sock->dev == NULL)
+                return -EBADFD;
+        pr_debug("%p %d %d %d\n", sk, llcp_sock->target_idx,
+                 llcp_sock->dsap, llcp_sock->ssap);
        if (llcp_sock == NULL || llcp_sock->dev == NULL)
                return -EBADFD;
-        addr->sa_family = AF_NFC;
+        uaddr->sa_family = AF_NFC;
        *len = sizeof(struct sockaddr_nfc_llcp);
        llcp_addr->dev_idx = llcp_sock->dev->idx;
+        llcp_addr->target_idx = llcp_sock->target_idx;
        llcp_addr->dsap = llcp_sock->dsap;
        llcp_addr->ssap = llcp_sock->ssap;
        llcp_addr->service_name_len = llcp_sock->service_name_len;
@@ -406,7 +416,8 @@ static int llcp_sock_release(struct socket *sock)
                }
        }
-        nfc_llcp_put_ssap(llcp_sock->local, llcp_sock->ssap);
+        if (llcp_sock->reserved_ssap < LLCP_SAP_MAX)
+                nfc_llcp_put_ssap(llcp_sock->local, llcp_sock->ssap);
        release_sock(sk);
@@ -486,6 +497,9 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
                ret = -ENOMEM;
                goto put_dev;
        }
+        llcp_sock->reserved_ssap = llcp_sock->ssap;
        if (addr->service_name_len == 0)
                llcp_sock->dsap = addr->dsap;
        else
@@ -687,6 +701,7 @@ struct sock *nfc_llcp_sock_alloc(struct socket *sock, int type, gfp_t gfp)
        llcp_sock->send_n = llcp_sock->send_ack_n = 0;
        llcp_sock->recv_n = llcp_sock->recv_ack_n = 0;
        llcp_sock->remote_ready = 1;
+        llcp_sock->reserved_ssap = LLCP_SAP_MAX;
        skb_queue_head_init(&llcp_sock->tx_queue);
        skb_queue_head_init(&llcp_sock->tx_pending_queue);
        skb_queue_head_init(&llcp_sock->tx_backlog_queue);
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 766a02b1dfa1..5bb4da680427 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -194,7 +194,7 @@ static void nci_rf_discover_req(struct nci_dev *ndev, unsigned long opt)
        }
        if ((cmd.num_disc_configs < NCI_MAX_NUM_RF_CONFIGS) &&
-            (protocols & NFC_PROTO_ISO14443_MASK)) {
+            (protocols & NFC_PROTO_ISO14443_B_MASK)) {
                cmd.disc_configs[cmd.num_disc_configs].rf_tech_and_mode =
                        NCI_NFC_B_PASSIVE_POLL_MODE;
                cmd.disc_configs[cmd.num_disc_configs].frequency = 1;
@@ -486,7 +486,8 @@ static int nci_activate_target(struct nfc_dev *nfc_dev,
                        param.rf_protocol = NCI_RF_PROTOCOL_T2T;
                else if (protocol == NFC_PROTO_FELICA)
                        param.rf_protocol = NCI_RF_PROTOCOL_T3T;
-                else if (protocol == NFC_PROTO_ISO14443)
+                else if (protocol == NFC_PROTO_ISO14443 ||
+                         protocol == NFC_PROTO_ISO14443_B)
                        param.rf_protocol = NCI_RF_PROTOCOL_ISO_DEP;
                else
                        param.rf_protocol = NCI_RF_PROTOCOL_NFC_DEP;
diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c
index 2ab196a9f228..af7a93b04393 100644
--- a/net/nfc/nci/ntf.c
+++ b/net/nfc/nci/ntf.c
@@ -170,7 +170,10 @@ static int nci_add_new_protocol(struct nci_dev *ndev,
        if (rf_protocol == NCI_RF_PROTOCOL_T2T)
                protocol = NFC_PROTO_MIFARE_MASK;
        else if (rf_protocol == NCI_RF_PROTOCOL_ISO_DEP)
-                protocol = NFC_PROTO_ISO14443_MASK;
+                if (rf_tech_and_mode == NCI_NFC_A_PASSIVE_POLL_MODE)
+                        protocol = NFC_PROTO_ISO14443_MASK;
+                else
+                        protocol = NFC_PROTO_ISO14443_B_MASK;
        else if (rf_protocol == NCI_RF_PROTOCOL_T3T)
                protocol = NFC_PROTO_FELICA_MASK;
        else
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index f4f07f9b61c0..4c51714ee741 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -634,6 +634,15 @@ static int nfc_genl_stop_poll(struct sk_buff *skb, struct genl_info *info)
        if (!dev)
                return -ENODEV;
+        device_lock(&dev->dev);
+        if (!dev->polling) {
+                device_unlock(&dev->dev);
+                return -EINVAL;
+        }
+        device_unlock(&dev->dev);
        mutex_lock(&dev->genl_data.genl_data_mutex);
        if (dev->genl_data.poll_req_pid != info->snd_pid) {
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index 55a28ab21db9..0f7e0d621ab0 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -10,7 +10,7 @@ obj-$(CONFIG_WEXT_SPY) += wext-spy.o
 obj-$(CONFIG_WEXT_PRIV) += wext-priv.o
 cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o
-cfg80211-y += mlme.o ibss.o sme.o chan.o ethtool.o mesh.o
+cfg80211-y += mlme.o ibss.o sme.o chan.o ethtool.o mesh.o ap.o
 cfg80211-$(CONFIG_CFG80211_DEBUGFS) += debugfs.o
 cfg80211-$(CONFIG_CFG80211_WEXT) += wext-compat.o wext-sme.o
 cfg80211-$(CONFIG_CFG80211_INTERNAL_REGDB) += regdb.o
diff --git a/net/wireless/ap.c b/net/wireless/ap.c
new file mode 100644
index 000000000000..fcc60d8dbefa
--- /dev/null
+++ b/net/wireless/ap.c
@@ -0,0 +1,46 @@
+#include <linux/ieee80211.h>
+#include <linux/export.h>
+#include <net/cfg80211.h>
+#include "nl80211.h"
+#include "core.h"
+static int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
+                              struct net_device *dev)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+        ASSERT_WDEV_LOCK(wdev);
+        if (!rdev->ops->stop_ap)
+                return -EOPNOTSUPP;
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
+                return -EOPNOTSUPP;
+        if (!wdev->beacon_interval)
+                return -ENOENT;
+        err = rdev->ops->stop_ap(&rdev->wiphy, dev);
+        if (!err) {
+                wdev->beacon_interval = 0;
+                wdev->channel = NULL;
+        }
+        return err;
+}
+int cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
+                     struct net_device *dev)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+        wdev_lock(wdev);
+        err = __cfg80211_stop_ap(rdev, dev);
+        wdev_unlock(wdev);
+        return err;
+}
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index c1999e45a07c..434c56b92c3c 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -82,13 +82,73 @@ int cfg80211_set_monitor_channel(struct cfg80211_registered_device *rdev,
                                 int freq, enum nl80211_channel_type chantype)
 {
        struct ieee80211_channel *chan;
+        int err;
        if (!rdev->ops->set_monitor_channel)
                return -EOPNOTSUPP;
+        if (!cfg80211_has_monitors_only(rdev))
+                return -EBUSY;
        chan = rdev_freq_to_chan(rdev, freq, chantype);
        if (!chan)
                return -EINVAL;
-        return rdev->ops->set_monitor_channel(&rdev->wiphy, chan, chantype);
+        err = rdev->ops->set_monitor_channel(&rdev->wiphy, chan, chantype);
+        if (!err) {
+                rdev->monitor_channel = chan;
+                rdev->monitor_channel_type = chantype;
+        }
+        return err;
+}
+void
+cfg80211_get_chan_state(struct cfg80211_registered_device *rdev,
+                        struct wireless_dev *wdev,
+                        struct ieee80211_channel **chan,
+                        enum cfg80211_chan_mode *chanmode)
+{
+        *chan = NULL;
+        *chanmode = CHAN_MODE_UNDEFINED;
+        ASSERT_RDEV_LOCK(rdev);
+        ASSERT_WDEV_LOCK(wdev);
+        if (!netif_running(wdev->netdev))
+                return;
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_ADHOC:
+                if (wdev->current_bss) {
+                        *chan = wdev->current_bss->pub.channel;
+                        *chanmode = wdev->ibss_fixed
+                                  ? CHAN_MODE_SHARED
+                                  : CHAN_MODE_EXCLUSIVE;
+                        return;
+                }
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_P2P_CLIENT:
+                if (wdev->current_bss) {
+                        *chan = wdev->current_bss->pub.channel;
+                        *chanmode = CHAN_MODE_SHARED;
+                        return;
+                }
+                break;
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
+        case NL80211_IFTYPE_MESH_POINT:
+                *chan = wdev->channel;
+                *chanmode = CHAN_MODE_SHARED;
+                return;
+        case NL80211_IFTYPE_MONITOR:
+        case NL80211_IFTYPE_AP_VLAN:
+        case NL80211_IFTYPE_WDS:
+                /* these interface types don't really have a channel */
+                return;
+        case NL80211_IFTYPE_UNSPECIFIED:
+        case NUM_NL80211_IFTYPES:
+                WARN_ON(1);
+        }
+        return;
 }
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 907f62c80e28..eb60410ae588 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -373,6 +373,14 @@ static int wiphy_verify_combinations(struct wiphy *wiphy)
                if (WARN_ON(!c->num_different_channels))
                        return -EINVAL;
+                /*
+                 * Put a sane limit on maximum number of different
+                 * channels to simplify channel accounting code.
+                 */
+                if (WARN_ON(c->num_different_channels >
+                                CFG80211_MAX_NUM_DIFFERENT_CHANNELS))
+                        return -EINVAL;
                if (WARN_ON(!c->n_limits))
                        return -EINVAL;
@@ -421,9 +429,11 @@ int wiphy_register(struct wiphy *wiphy)
        int i;
        u16 ifmodes = wiphy->interface_modes;
+#ifdef CONFIG_PM
        if (WARN_ON((wiphy->wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
                    !(wiphy->wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)))
                return -EINVAL;
+#endif
        if (WARN_ON(wiphy->ap_sme_capa &&
                    !(wiphy->flags & WIPHY_FLAG_HAVE_AP_SME)))
@@ -458,8 +468,14 @@ int wiphy_register(struct wiphy *wiphy)
                        continue;
                sband->band = band;
+                if (WARN_ON(!sband->n_channels))
-                if (WARN_ON(!sband->n_channels || !sband->n_bitrates))
+                        return -EINVAL;
+                /*
+                 * on 60gHz band, there are no legacy rates, so
+                 * n_bitrates is 0
+                 */
+                if (WARN_ON(band != IEEE80211_BAND_60GHZ &&
+                            !sband->n_bitrates))
                        return -EINVAL;
                /*
@@ -500,12 +516,14 @@ int wiphy_register(struct wiphy *wiphy)
                return -EINVAL;
        }
+#ifdef CONFIG_PM
        if (rdev->wiphy.wowlan.n_patterns) {
                if (WARN_ON(!rdev->wiphy.wowlan.pattern_min_len ||
                            rdev->wiphy.wowlan.pattern_min_len >
                            rdev->wiphy.wowlan.pattern_max_len))
                        return -EINVAL;
        }
+#endif
        /* check and set up bitrates */
        ieee80211_set_bitrate_flags(wiphy);
@@ -713,6 +731,61 @@ static struct device_type wiphy_type = {
        .name   = "wlan",
 };
+static struct ieee80211_channel *
+cfg80211_get_any_chan(struct cfg80211_registered_device *rdev)
+{
+        struct ieee80211_supported_band *sband;
+        int i;
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
+                sband = rdev->wiphy.bands[i];
+                if (sband && sband->n_channels > 0)
+                        return &sband->channels[0];
+        }
+        return NULL;
+}
+static void cfg80211_init_mon_chan(struct cfg80211_registered_device *rdev)
+{
+        struct ieee80211_channel *chan;
+        chan = cfg80211_get_any_chan(rdev);
+        if (WARN_ON(!chan))
+                return;
+        mutex_lock(&rdev->devlist_mtx);
+        WARN_ON(cfg80211_set_monitor_channel(rdev, chan->center_freq,
+                                             NL80211_CHAN_NO_HT));
+        mutex_unlock(&rdev->devlist_mtx);
+}
+void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev,
+                               enum nl80211_iftype iftype, int num)
+{
+        bool has_monitors_only_old = cfg80211_has_monitors_only(rdev);
+        bool has_monitors_only_new;
+        ASSERT_RTNL();
+        rdev->num_running_ifaces += num;
+        if (iftype == NL80211_IFTYPE_MONITOR)
+                rdev->num_running_monitor_ifaces += num;
+        has_monitors_only_new = cfg80211_has_monitors_only(rdev);
+        if (has_monitors_only_new != has_monitors_only_old) {
+                rdev->ops->set_monitor_enabled(&rdev->wiphy,
+                                               has_monitors_only_new);
+                if (!has_monitors_only_new) {
+                        rdev->monitor_channel = NULL;
+                        rdev->monitor_channel_type = NL80211_CHAN_NO_HT;
+                } else {
+                        cfg80211_init_mon_chan(rdev);
+                }
+        }
+}
 static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                                         unsigned long state,
                                         void *ndev)
@@ -806,12 +879,16 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                case NL80211_IFTYPE_MESH_POINT:
                        cfg80211_leave_mesh(rdev, dev);
                        break;
+                case NL80211_IFTYPE_AP:
+                        cfg80211_stop_ap(rdev, dev);
+                        break;
                default:
                        break;
                }
                wdev->beacon_interval = 0;
                break;
        case NETDEV_DOWN:
+                cfg80211_update_iface_num(rdev, wdev->iftype, -1);
                dev_hold(dev);
                queue_work(cfg80211_wq, &wdev->cleanup_work);
                break;
@@ -917,9 +994,12 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                        return notifier_from_errno(-EOPNOTSUPP);
                if (rfkill_blocked(rdev->rfkill))
                        return notifier_from_errno(-ERFKILL);
+                mutex_lock(&rdev->devlist_mtx);
                ret = cfg80211_can_add_interface(rdev, wdev->iftype);
+                mutex_unlock(&rdev->devlist_mtx);
                if (ret)
                        return notifier_from_errno(ret);
+                cfg80211_update_iface_num(rdev, wdev->iftype, 1);
                break;
        }
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 609a579255ac..377dc394f48c 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -13,6 +13,7 @@
 #include <linux/debugfs.h>
 #include <linux/rfkill.h>
 #include <linux/workqueue.h>
+#include <linux/rtnetlink.h>
 #include <net/genetlink.h>
 #include <net/cfg80211.h>
 #include "reg.h"
@@ -56,6 +57,13 @@ struct cfg80211_registered_device {
        u32 ap_beacons_nlpid;
+        /* protected by RTNL only */
+        int num_running_ifaces;
+        int num_running_monitor_ifaces;
+        struct ieee80211_channel *monitor_channel;
+        enum nl80211_channel_type monitor_channel_type;
        /* BSSes/scanning */
        spinlock_t bss_lock;
        struct list_head bss_list;
@@ -197,6 +205,14 @@ static inline void wdev_unlock(struct wireless_dev *wdev)
 #define ASSERT_RDEV_LOCK(rdev) lockdep_assert_held(&(rdev)->mtx)
 #define ASSERT_WDEV_LOCK(wdev) lockdep_assert_held(&(wdev)->mtx)
+static inline bool cfg80211_has_monitors_only(struct cfg80211_registered_device *rdev)
+{
+        ASSERT_RTNL();
+        return rdev->num_running_ifaces == rdev->num_running_monitor_ifaces &&
+               rdev->num_running_ifaces > 0;
+}
 enum cfg80211_event_type {
        EVENT_CONNECT_RESULT,
        EVENT_ROAMED,
@@ -241,6 +257,12 @@ struct cfg80211_cached_keys {
        int def, defmgmt;
 };
+enum cfg80211_chan_mode {
+        CHAN_MODE_UNDEFINED,
+        CHAN_MODE_SHARED,
+        CHAN_MODE_EXCLUSIVE,
+};
 /* free object */
 extern void cfg80211_dev_free(struct cfg80211_registered_device *rdev);
@@ -289,6 +311,10 @@ int cfg80211_set_mesh_freq(struct cfg80211_registered_device *rdev,
                           struct wireless_dev *wdev, int freq,
                           enum nl80211_channel_type channel_type);
+/* AP */
+int cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
+                     struct net_device *dev);
 /* MLME */
 int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
                         struct net_device *dev,
@@ -404,9 +430,20 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                          u32 *flags, struct vif_params *params);
 void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev);
-int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
+int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
-                                  struct wireless_dev *wdev,
+                                 struct wireless_dev *wdev,
-                                  enum nl80211_iftype iftype);
+                                 enum nl80211_iftype iftype,
+                                 struct ieee80211_channel *chan,
+                                 enum cfg80211_chan_mode chanmode);
+static inline int
+cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
+                              struct wireless_dev *wdev,
+                              enum nl80211_iftype iftype)
+{
+        return cfg80211_can_use_iftype_chan(rdev, wdev, iftype, NULL,
+                                            CHAN_MODE_UNDEFINED);
+}
 static inline int
 cfg80211_can_add_interface(struct cfg80211_registered_device *rdev,
@@ -415,6 +452,22 @@ cfg80211_can_add_interface(struct cfg80211_registered_device *rdev,
        return cfg80211_can_change_interface(rdev, NULL, iftype);
 }
+static inline int
+cfg80211_can_use_chan(struct cfg80211_registered_device *rdev,
+                      struct wireless_dev *wdev,
+                      struct ieee80211_channel *chan,
+                      enum cfg80211_chan_mode chanmode)
+{
+        return cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
+                                            chan, chanmode);
+}
+void
+cfg80211_get_chan_state(struct cfg80211_registered_device *rdev,
+                        struct wireless_dev *wdev,
+                        struct ieee80211_channel **chan,
+                        enum cfg80211_chan_mode *chanmode);
 struct ieee80211_channel *
 rdev_freq_to_chan(struct cfg80211_registered_device *rdev,
                  int freq, enum nl80211_channel_type channel_type);
@@ -428,6 +481,11 @@ int ieee80211_get_ratemask(struct ieee80211_supported_band *sband,
 int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
                                 u32 beacon_int);
+void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev,
+                               enum nl80211_iftype iftype, int num);
+#define CFG80211_MAX_NUM_DIFFERENT_CHANNELS 10
 #ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS
 #define CFG80211_DEV_WARN_ON(cond)      WARN_ON(cond)
 #else
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index 89baa3328411..ca5672f6ee2f 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -113,10 +113,21 @@ int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
                kfree(wdev->connect_keys);
        wdev->connect_keys = connkeys;
+        wdev->ibss_fixed = params->channel_fixed;
 #ifdef CONFIG_CFG80211_WEXT
        wdev->wext.ibss.channel = params->channel;
 #endif
        wdev->sme_state = CFG80211_SME_CONNECTING;
+        err = cfg80211_can_use_chan(rdev, wdev, params->channel,
+                                    params->channel_fixed
+                                    ? CHAN_MODE_SHARED
+                                    : CHAN_MODE_EXCLUSIVE);
+        if (err) {
+                wdev->connect_keys = NULL;
+                return err;
+        }
        err = rdev->ops->join_ibss(&rdev->wiphy, dev, params);
        if (err) {
                wdev->connect_keys = NULL;
diff --git a/net/wireless/mesh.c b/net/wireless/mesh.c
index 3b73b07486cf..c384e77ff77a 100644
--- a/net/wireless/mesh.c
+++ b/net/wireless/mesh.c
@@ -155,10 +155,16 @@ int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
                                          setup->channel_type))
                return -EINVAL;
+        err = cfg80211_can_use_chan(rdev, wdev, setup->channel,
+                                    CHAN_MODE_SHARED);
+        if (err)
+                return err;
        err = rdev->ops->join_mesh(&rdev->wiphy, dev, conf, setup);
        if (!err) {
                memcpy(wdev->ssid, setup->mesh_id, setup->mesh_id_len);
                wdev->mesh_id_len = setup->mesh_id_len;
+                wdev->channel = setup->channel;
        }
        return err;
@@ -172,9 +178,11 @@ int cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
        struct wireless_dev *wdev = dev->ieee80211_ptr;
        int err;
+        mutex_lock(&rdev->devlist_mtx);
        wdev_lock(wdev);
        err = __cfg80211_join_mesh(rdev, dev, setup, conf);
        wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
        return err;
 }
@@ -184,6 +192,7 @@ int cfg80211_set_mesh_freq(struct cfg80211_registered_device *rdev,
                           enum nl80211_channel_type channel_type)
 {
        struct ieee80211_channel *channel;
+        int err;
        channel = rdev_freq_to_chan(rdev, freq, channel_type);
        if (!channel || !cfg80211_can_beacon_sec_chan(&rdev->wiphy,
@@ -205,9 +214,19 @@ int cfg80211_set_mesh_freq(struct cfg80211_registered_device *rdev,
                if (!netif_running(wdev->netdev))
                        return -ENETDOWN;
-                return rdev->ops->libertas_set_mesh_channel(&rdev->wiphy,
-                                                            wdev->netdev,
+                err = cfg80211_can_use_chan(rdev, wdev, channel,
-                                                            channel);
+                                            CHAN_MODE_SHARED);
+                if (err)
+                        return err;
+                err = rdev->ops->libertas_set_mesh_channel(&rdev->wiphy,
+                                                           wdev->netdev,
+                                                           channel);
+                if (!err)
+                        wdev->channel = channel;
+                return err;
        }
        if (wdev->mesh_id_len)
@@ -249,8 +268,11 @@ static int __cfg80211_leave_mesh(struct cfg80211_registered_device *rdev,
                return -ENOTCONN;
        err = rdev->ops->leave_mesh(&rdev->wiphy, dev);
-        if (!err)
+        if (!err) {
                wdev->mesh_id_len = 0;
+                wdev->channel = NULL;
+        }
        return err;
 }
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index da4406f11929..d4fece3bb18a 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -302,8 +302,14 @@ int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
        if (!req.bss)
                return -ENOENT;
+        err = cfg80211_can_use_chan(rdev, wdev, req.bss->channel,
+                                    CHAN_MODE_SHARED);
+        if (err)
+                goto out;
        err = rdev->ops->auth(&rdev->wiphy, dev, &req);
+out:
        cfg80211_put_bss(req.bss);
        return err;
 }
@@ -317,11 +323,13 @@ int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
 {
        int err;
+        mutex_lock(&rdev->devlist_mtx);
        wdev_lock(dev->ieee80211_ptr);
        err = __cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
                                   ssid, ssid_len, ie, ie_len,
                                   key, key_len, key_idx);
        wdev_unlock(dev->ieee80211_ptr);
+        mutex_unlock(&rdev->devlist_mtx);
        return err;
 }
@@ -397,8 +405,14 @@ int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
                return -ENOENT;
        }
+        err = cfg80211_can_use_chan(rdev, wdev, req.bss->channel,
+                                    CHAN_MODE_SHARED);
+        if (err)
+                goto out;
        err = rdev->ops->assoc(&rdev->wiphy, dev, &req);
+out:
        if (err) {
                if (was_connected)
                        wdev->sme_state = CFG80211_SME_CONNECTED;
@@ -421,11 +435,13 @@ int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
        struct wireless_dev *wdev = dev->ieee80211_ptr;
        int err;
+        mutex_lock(&rdev->devlist_mtx);
        wdev_lock(wdev);
        err = __cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
                                    ssid, ssid_len, ie, ie_len, use_mfp, crypt,
                                    assoc_flags, ht_capa, ht_capa_mask);
        wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
        return err;
 }
@@ -947,6 +963,7 @@ void cfg80211_ch_switch_notify(struct net_device *dev, int freq,
        if (WARN_ON(!chan))
                goto out;
+        wdev->channel = chan;
        nl80211_ch_switch_notify(rdev, dev, freq, type, GFP_KERNEL);
 out:
        wdev_unlock(wdev);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 3b508eaf2d07..0249cea53852 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -921,6 +921,15 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                                dev->wiphy.bands[band]->ht_cap.ampdu_density)))
                        goto nla_put_failure;
+                /* add VHT info */
+                if (dev->wiphy.bands[band]->vht_cap.vht_supported &&
+                    (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
+                             sizeof(dev->wiphy.bands[band]->vht_cap.vht_mcs),
+                             &dev->wiphy.bands[band]->vht_cap.vht_mcs) ||
+                     nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
+                                 dev->wiphy.bands[band]->vht_cap.cap)))
+                        goto nla_put_failure;
                /* add frequencies */
                nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
                if (!nl_freqs)
@@ -1112,6 +1121,7 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                nla_nest_end(msg, nl_ifs);
        }
+#ifdef CONFIG_PM
        if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
                struct nlattr *nl_wowlan;
@@ -1152,6 +1162,7 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                nla_nest_end(msg, nl_wowlan);
        }
+#endif
        if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
                                dev->wiphy.software_iftypes))
@@ -1678,16 +1689,11 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                        (cfg80211_rdev_list_generation << 2)))
                goto nla_put_failure;
-        if (rdev->ops->get_channel) {
+        if (rdev->monitor_channel) {
-                struct ieee80211_channel *chan;
+                if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
-                enum nl80211_channel_type channel_type;
+                                rdev->monitor_channel->center_freq) ||
+                    nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
-                chan = rdev->ops->get_channel(&rdev->wiphy, &channel_type);
+                                rdev->monitor_channel_type))
-                if (chan &&
-                    (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
-                                    chan->center_freq) ||
-                     nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
-                                    channel_type)))
                        goto nla_put_failure;
        }
@@ -2472,11 +2478,20 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
                                          params.channel_type))
                return -EINVAL;
+        mutex_lock(&rdev->devlist_mtx);
+        err = cfg80211_can_use_chan(rdev, wdev, params.channel,
+                                    CHAN_MODE_SHARED);
+        mutex_unlock(&rdev->devlist_mtx);
+        if (err)
+                return err;
        err = rdev->ops->start_ap(&rdev->wiphy, dev, &params);
        if (!err) {
                wdev->preset_chan = params.channel;
                wdev->preset_chantype = params.channel_type;
                wdev->beacon_interval = params.beacon_interval;
+                wdev->channel = params.channel;
        }
        return err;
 }
@@ -2510,23 +2525,8 @@ static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
 {
        struct cfg80211_registered_device *rdev = info->user_ptr[0];
        struct net_device *dev = info->user_ptr[1];
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        int err;
-        if (!rdev->ops->stop_ap)
+        return cfg80211_stop_ap(rdev, dev);
-                return -EOPNOTSUPP;
-        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
-            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
-                return -EOPNOTSUPP;
-        if (!wdev->beacon_interval)
-                return -ENOENT;
-        err = rdev->ops->stop_ap(&rdev->wiphy, dev);
-        if (!err)
-                wdev->beacon_interval = 0;
-        return err;
 }
 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
@@ -2618,7 +2618,8 @@ static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
                                 int attr)
 {
        struct nlattr *rate;
-        u16 bitrate;
+        u32 bitrate;
+        u16 bitrate_compat;
        rate = nla_nest_start(msg, attr);
        if (!rate)
@@ -2626,8 +2627,12 @@ static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
        /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
        bitrate = cfg80211_calculate_bitrate(info);
+        /* report 16-bit bitrate only if we can */
+        bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
        if ((bitrate > 0 &&
-             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate)) ||
+             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate)) ||
+            (bitrate_compat > 0 &&
+             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat)) ||
            ((info->flags & RATE_INFO_FLAGS_MCS) &&
             nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) ||
            ((info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) &&
@@ -6276,6 +6281,7 @@ static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
        return cfg80211_leave_mesh(rdev, dev);
 }
+#ifdef CONFIG_PM
 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
 {
        struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -6504,6 +6510,7 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
        kfree(new_triggers.patterns);
        return err;
 }
+#endif
 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
 {
@@ -7158,6 +7165,7 @@ static struct genl_ops nl80211_ops[] = {
                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                  NL80211_FLAG_NEED_RTNL,
        },
+#ifdef CONFIG_PM
        {
                .cmd = NL80211_CMD_GET_WOWLAN,
                .doit = nl80211_get_wowlan,
@@ -7174,6 +7182,7 @@ static struct genl_ops nl80211_ops[] = {
                .internal_flags = NL80211_FLAG_NEED_WIPHY |
                                  NL80211_FLAG_NEED_RTNL,
        },
+#endif
        {
                .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
                .doit = nl80211_set_rekey_data,
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index baf5704740ee..b2b32229b607 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -129,7 +129,7 @@ static DECLARE_DELAYED_WORK(reg_timeout, reg_timeout_work);
 /* We keep a static world regulatory domain in case of the absence of CRDA */
 static const struct ieee80211_regdomain world_regdom = {
-        .n_reg_rules = 5,
+        .n_reg_rules = 6,
        .alpha2 =  "00",
        .reg_rules = {
                /* IEEE 802.11b/g, channels 1..11 */
@@ -156,6 +156,9 @@ static const struct ieee80211_regdomain world_regdom = {
                REG_RULE(5745-10, 5825+10, 40, 6, 20,
                        NL80211_RRF_PASSIVE_SCAN |
                        NL80211_RRF_NO_IBSS),
+                /* IEEE 802.11ad (60gHz), channels 1..3 */
+                REG_RULE(56160+2160*1-1080, 56160+2160*3+1080, 2160, 0, 0, 0),
        }
 };
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 316cfd00914f..e31f1dba79ec 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -35,19 +35,29 @@ int ieee80211_channel_to_frequency(int chan, enum ieee80211_band band)
 {
        /* see 802.11 17.3.8.3.2 and Annex J
         * there are overlapping channel numbers in 5GHz and 2GHz bands */
-        if (band == IEEE80211_BAND_5GHZ) {
+        if (chan <= 0)
-                if (chan >= 182 && chan <= 196)
+                return 0; /* not supported */
-                        return 4000 + chan * 5;
+        switch (band) {
-                else
+        case IEEE80211_BAND_2GHZ:
-                        return 5000 + chan * 5;
-        } else { /* IEEE80211_BAND_2GHZ */
                if (chan == 14)
                        return 2484;
                else if (chan < 14)
                        return 2407 + chan * 5;
+                break;
+        case IEEE80211_BAND_5GHZ:
+                if (chan >= 182 && chan <= 196)
+                        return 4000 + chan * 5;
                else
-                        return 0; /* not supported */
+                        return 5000 + chan * 5;
+                break;
+        case IEEE80211_BAND_60GHZ:
+                if (chan < 5)
+                        return 56160 + chan * 2160;
+                break;
+        default:
+                ;
        }
+        return 0; /* not supported */
 }
 EXPORT_SYMBOL(ieee80211_channel_to_frequency);
@@ -60,8 +70,12 @@ int ieee80211_frequency_to_channel(int freq)
                return (freq - 2407) / 5;
        else if (freq >= 4910 && freq <= 4980)
                return (freq - 4000) / 5;
-        else
+        else if (freq <= 45000) /* DMG band lower limit */
                return (freq - 5000) / 5;
+        else if (freq >= 58320 && freq <= 64800)
+                return (freq - 56160) / 2160;
+        else
+                return 0;
 }
 EXPORT_SYMBOL(ieee80211_frequency_to_channel);
@@ -137,6 +151,11 @@ static void set_mandatory_flags_band(struct ieee80211_supported_band *sband,
                }
                WARN_ON(want != 0 && want != 3 && want != 6);
                break;
+        case IEEE80211_BAND_60GHZ:
+                /* check for mandatory HT MCS 1..4 */
+                WARN_ON(!sband->ht_cap.ht_supported);
+                WARN_ON((sband->ht_cap.mcs.rx_mask[0] & 0x1e) != 0x1e);
+                break;
        case IEEE80211_NUM_BANDS:
                WARN_ON(1);
                break;
@@ -805,8 +824,10 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                return -EBUSY;
        if (ntype != otype && netif_running(dev)) {
+                mutex_lock(&rdev->devlist_mtx);
                err = cfg80211_can_change_interface(rdev, dev->ieee80211_ptr,
                                                    ntype);
+                mutex_unlock(&rdev->devlist_mtx);
                if (err)
                        return err;
@@ -814,6 +835,9 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                dev->ieee80211_ptr->mesh_id_up_len = 0;
                switch (otype) {
+                case NL80211_IFTYPE_AP:
+                        cfg80211_stop_ap(rdev, dev);
+                        break;
                case NL80211_IFTYPE_ADHOC:
                        cfg80211_leave_ibss(rdev, dev, false);
                        break;
@@ -868,15 +892,69 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                }
        }
+        if (!err && ntype != otype && netif_running(dev)) {
+                cfg80211_update_iface_num(rdev, ntype, 1);
+                cfg80211_update_iface_num(rdev, otype, -1);
+        }
        return err;
 }
-u16 cfg80211_calculate_bitrate(struct rate_info *rate)
+static u32 cfg80211_calculate_bitrate_60g(struct rate_info *rate)
+{
+        static const u32 __mcs2bitrate[] = {
+                /* control PHY */
+                [0] =   275,
+                /* SC PHY */
+                [1] =  3850,
+                [2] =  7700,
+                [3] =  9625,
+                [4] = 11550,
+                [5] = 12512, /* 1251.25 mbps */
+                [6] = 15400,
+                [7] = 19250,
+                [8] = 23100,
+                [9] = 25025,
+                [10] = 30800,
+                [11] = 38500,
+                [12] = 46200,
+                /* OFDM PHY */
+                [13] =  6930,
+                [14] =  8662, /* 866.25 mbps */
+                [15] = 13860,
+                [16] = 17325,
+                [17] = 20790,
+                [18] = 27720,
+                [19] = 34650,
+                [20] = 41580,
+                [21] = 45045,
+                [22] = 51975,
+                [23] = 62370,
+                [24] = 67568, /* 6756.75 mbps */
+                /* LP-SC PHY */
+                [25] =  6260,
+                [26] =  8340,
+                [27] = 11120,
+                [28] = 12510,
+                [29] = 16680,
+                [30] = 22240,
+                [31] = 25030,
+        };
+        if (WARN_ON_ONCE(rate->mcs >= ARRAY_SIZE(__mcs2bitrate)))
+                return 0;
+        return __mcs2bitrate[rate->mcs];
+}
+u32 cfg80211_calculate_bitrate(struct rate_info *rate)
 {
        int modulation, streams, bitrate;
        if (!(rate->flags & RATE_INFO_FLAGS_MCS))
                return rate->legacy;
+        if (rate->flags & RATE_INFO_FLAGS_60G)
+                return cfg80211_calculate_bitrate_60g(rate);
        /* the formula below does only work for MCS values smaller than 32 */
        if (WARN_ON_ONCE(rate->mcs >= 32))
@@ -930,27 +1008,48 @@ int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
        return res;
 }
-int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
+int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
-                                  struct wireless_dev *wdev,
+                                 struct wireless_dev *wdev,
-                                  enum nl80211_iftype iftype)
+                                 enum nl80211_iftype iftype,
+                                 struct ieee80211_channel *chan,
+                                 enum cfg80211_chan_mode chanmode)
 {
        struct wireless_dev *wdev_iter;
        u32 used_iftypes = BIT(iftype);
        int num[NUM_NL80211_IFTYPES];
+        struct ieee80211_channel
+                        *used_channels[CFG80211_MAX_NUM_DIFFERENT_CHANNELS];
+        struct ieee80211_channel *ch;
+        enum cfg80211_chan_mode chmode;
+        int num_different_channels = 0;
        int total = 1;
        int i, j;
        ASSERT_RTNL();
+        lockdep_assert_held(&rdev->devlist_mtx);
        /* Always allow software iftypes */
        if (rdev->wiphy.software_iftypes & BIT(iftype))
                return 0;
        memset(num, 0, sizeof(num));
+        memset(used_channels, 0, sizeof(used_channels));
        num[iftype] = 1;
-        mutex_lock(&rdev->devlist_mtx);
+        switch (chanmode) {
+        case CHAN_MODE_UNDEFINED:
+                break;
+        case CHAN_MODE_SHARED:
+                WARN_ON(!chan);
+                used_channels[0] = chan;
+                num_different_channels++;
+                break;
+        case CHAN_MODE_EXCLUSIVE:
+                num_different_channels++;
+                break;
+        }
        list_for_each_entry(wdev_iter, &rdev->netdev_list, list) {
                if (wdev_iter == wdev)
                        continue;
@@ -960,11 +1059,33 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
                if (rdev->wiphy.software_iftypes & BIT(wdev_iter->iftype))
                        continue;
+                cfg80211_get_chan_state(rdev, wdev_iter, &ch, &chmode);
+                switch (chmode) {
+                case CHAN_MODE_UNDEFINED:
+                        break;
+                case CHAN_MODE_SHARED:
+                        for (i = 0; i < CFG80211_MAX_NUM_DIFFERENT_CHANNELS; i++)
+                                if (!used_channels[i] || used_channels[i] == ch)
+                                        break;
+                        if (i == CFG80211_MAX_NUM_DIFFERENT_CHANNELS)
+                                return -EBUSY;
+                        if (used_channels[i] == NULL) {
+                                used_channels[i] = ch;
+                                num_different_channels++;
+                        }
+                        break;
+                case CHAN_MODE_EXCLUSIVE:
+                        num_different_channels++;
+                        break;
+                }
                num[wdev_iter->iftype]++;
                total++;
                used_iftypes |= BIT(wdev_iter->iftype);
        }
-        mutex_unlock(&rdev->devlist_mtx);
        if (total == 1)
                return 0;
@@ -976,12 +1097,15 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
                c = &rdev->wiphy.iface_combinations[i];
+                if (total > c->max_interfaces)
+                        continue;
+                if (num_different_channels > c->num_different_channels)
+                        continue;
                limits = kmemdup(c->limits, sizeof(limits[0]) * c->n_limits,
                                 GFP_KERNEL);
                if (!limits)
                        return -ENOMEM;
-                if (total > c->max_interfaces)
-                        goto cont;
                for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
                        if (rdev->wiphy.software_iftypes & BIT(iftype))
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index bc879833b21f..7df42f541873 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -827,8 +827,6 @@ static int cfg80211_wext_giwfreq(struct net_device *dev,
 {
        struct wireless_dev *wdev = dev->ieee80211_ptr;
        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
-        struct ieee80211_channel *chan;
-        enum nl80211_channel_type channel_type;
        switch (wdev->iftype) {
        case NL80211_IFTYPE_STATION:
@@ -836,13 +834,10 @@ static int cfg80211_wext_giwfreq(struct net_device *dev,
        case NL80211_IFTYPE_ADHOC:
                return cfg80211_ibss_wext_giwfreq(dev, info, freq, extra);
        case NL80211_IFTYPE_MONITOR:
-                if (!rdev->ops->get_channel)
+                if (!rdev->monitor_channel)
                        return -EINVAL;
-                chan = rdev->ops->get_channel(wdev->wiphy, &channel_type);
+                freq->m = rdev->monitor_channel->center_freq;
-                if (!chan)
-                        return -EINVAL;
-                freq->m = chan->center_freq;
                freq->e = 6;
                return 0;
        default: